CVE-2026-63688: Critical severity Dell Container Storage Modules vulnerability
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell Container Storage Modules (CSM)to a version that resolves this vulnerability.Fixed in v1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Dell Container Storage Modules deployments using versions earlier than v1.18.0 are affected where the csm-authorization-storage gRPC server is present. The issue can expose administrator credentials for all storage arrays registered with the affected deployment.
Does exploitation require credentials or user interaction?
No. The provided vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
What is the remediation version?
Upgrade Dell Container Storage Modules to v1.18.0 or later.