techjacksolutions.com • 3w
Dell CSM Authorization Module: Six Critical Flaws Enable Full Admin Compromise of Kubernetes Storage Infrastructure
Six critical vulnerabilities in the Dell Container Storage Modules (CSM) csm-authorization-storage gRPC service enable unauthenticated remote attackers to gain full administrative control over Kubernetes storage planes. The most severe flaw, CVE-2026-63688 (CVSS 10.0), permits unauthenticated remote code execution via crafted gRPC calls. Chained vulnerabilities allow for privilege escalation, storage class injection, and unauthorized snapshot access, impacting Dell CSI drivers in versions <1.8.0, 1.9.x<1.9.3, and 1.10.x<1.10.1. Successful exploitation allows adversaries to manipulate persistent volumes, exfiltrate data, or deploy ransomware across an estimated 2,000 exposed clusters globally.