CVE-2026-70411: High severity Dell Container Storage Modules (CSM) vulnerability
Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell Container Storage Modules (CSM)to a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated attacker on an adjacent network can potentially exploit the affected csm-authorization-tenant gRPC TenantService. No prior privileges or user interaction are required.
What could an attacker do after exploitation?
An attacker could create tenant entities without authorization, inject roles across tenants, and modify storage access-control flags. This can affect the integrity of tenant separation and storage authorization.
Which versions are affected?
Dell Container Storage Modules versions earlier than 1.18.0 are affected. Version 1.18.0 is the stated fixed-version boundary.