Affected Systems

Dell Container Storage Modules (CSM) Authorization module, versions prior to 1.18.0. Affects environments integrating Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays with Kubernetes.

Exploitation Status

No active exploitation reported by Dell. However, Dell vulnerabilities have been exploited by state-sponsored actors (Lazarus, UNC6201/Silk Typhoon) in recent years, establishing precedent for targeting Dell enterprise products.

Business Impact

Unauthenticated remote attackers can gain full administrative control over Dell storage infrastructure and Kubernetes environments. CVE-2026-63688 exposes storage backend admin credentials for all registered arrays. CVE-2026-63692 bypasses authentication in authorization proxy and tenant service. Four additional critical flaws (CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273) enable root access on cluster nodes, token forgery, and unauthorized access to Kubernetes Secrets. Complete compromise of multi-tenant storage and orchestration layer is possible.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Dell Container Storage Modules to version 1.18.0 or later immediately on all Kubernetes clusters with Dell CSI drivers
  • Audit CSM Authorization module logs for unauthorized access attempts or credential retrieval from storage backends prior to patching
  • Rotate all storage array administrator credentials and Kubernetes service account tokens after applying patches
  • Review Kubernetes RBAC policies and Secret access logs for anomalous activity across all tenants
  • Isolate CSM Authorization proxy and tenant service network access to trusted management networks only until patching is complete