Dell CSM Authorization Module: Six Critical Flaws Enable Full Admin Compromise of Kubernetes Storage Infrastructure

Six critical vulnerabilities in the Dell Container Storage Modules (CSM) csm-authorization-storage gRPC service enable unauthenticated remote attackers to gain full administrative control over Kubernetes storage planes. The most severe flaw, CVE-2026-63688 (CVSS 10.0), permits unauthenticated remote code execution via crafted gRPC calls. Chained vulnerabilities allow for privilege escalation, storage class injection, and unauthorized snapshot access, impacting Dell CSI drivers in versions <1.8.0, 1.9.x<1.9.3, and 1.10.x<1.10.1. Successful exploitation allows adversaries to manipulate persistent volumes, exfiltrate data, or deploy ransomware across an estimated 2,000 exposed clusters globally.

• Vulnerability Analysis: Broken Authorization & RCE
• CVE-2026-63688 (CVSS 10.0): Missing authentication in the gRPC server allows unauthenticated remote code execution (RCE) via crafted requests.
• CVE-2026-63689 (CVSS 9.8): Improper authorization logic enables unprivileged users to escalate privileges to an administrative role.

• CVE-2026-63690 (CVSS 9.1): Insufficient input validation within the service facilitates malicious storage class injection.

• Technical Mechanics: Data & Logic Exploitation

• CVE-2026-63691 (CVSS 8.8): A race condition during volume snapshot creation allows unauthorized access to sensitive cluster snapshots.
• CVE-2026-63692 (CVSS 7.5): A debug endpoint leaks internal authentication tokens, providing a direct pathway for credential theft.

• CVE-2026-63693 (CVSS 6.5): Improper logging mechanisms enable log-forgery attacks, allowing attackers to mask exploitation activities.

• Impact Assessment: Kubernetes Storage Plane Compromise

• Administrative Takeover: Attackers gain the ability to create, modify, or delete Persistent Volumes (PVs), snapshots, and storage classes.
• Lateral Movement: Compromised storage classes can be leveraged to bridge the gap from the storage layer to containerized workloads.

• Business Risk: High potential for large-scale data exfiltration, ransomware deployment via malicious volume mounting, and total service disruption.

• Detection & Mitigation Strategies

• Immediate Patching: Update Dell CSM to versions 1.8.0, 1.9.3, 1.10.1, or later to remediate all known critical vulnerabilities.
• Network Hardening: Implement Kubernetes NetworkPolicies or firewalls to restrict gRPC port 50051 access to trusted nodes and namespaces only.
• Continuous Monitoring: Monitor CSI pod logs for anomalous gRPC requests and review Kubernetes audit logs for unauthorized storage object modifications.