Dell is urging administrators to update affected Container Storage Modules (CSM) deployments to version 1.18.0 or later as soon as possible. Dell’s October 1, 2026 advisory lists two CSM Authorization vulnerabilities with maximum CVSS base scores of 10.0, along with other high-severity flaws. It lists no workaround. For deployments affected by CVE-2026-54472, Dell also advises immediately rotating JWT signing secrets.
What is affected
Dell CSM extends Dell Kubernetes Container Storage Interface (CSI) drivers, connecting Kubernetes environments to enterprise storage. Supported storage families reported by BleepingComputer include PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT. This is an enterprise Kubernetes software issue, not a general Dell PC update. Dell advisory DSA-2026-448 lists CSM versions before 1.17.0 as affected and 1.18.0 or later as remediated; Dell cautions that its affected-product table may not include every supported version. Check the live advisory against the exact modules and versions installed in each environment.
Which vulnerabilities make this urgent
Dell’s advisory includes multiple findings. These six illustrate the severity and range of potential impact, but are not the complete list; consult Dell’s full CVE and component table for all findings. CVSS figures below are Dell-listed base scores, not measures of whether a system has been exploited.
- CVE-2026-63688 (CVSS 10.0): In CSM Authorization 2.4.0, the
csm-authorization-storagegRPC server lacks authentication for a critical function. A remote unauthenticated attacker could access administrator credentials for registered storage arrays and bypass authorization to gain administrative control of storage infrastructure. Dell advisory; NVD entry. - CVE-2026-63692 (CVSS 10.0): Missing authentication in CSM Authorization 2.4.0’s authorization proxy and tenant service could let an unauthenticated network attacker bypass authentication and gain administrator-level privileges affecting storage resources across tenants. Dell advisory; NVD entry.
- CVE-2026-67269 (CVSS 9.9): A flaw in the CSM Operator’s ContainerStorageModule custom-resource reconciler could allow a low-privileged remote attacker to escalate privileges to root on cluster nodes. Dell advisory.
- CVE-2026-54472 (CVSS 9.8): Dell says hard-coded credentials could enable an unauthenticated remote attacker to forge administrative tokens and manage storage access policies. Dell specifically advises immediate rotation of JWT signing secrets. Dell advisory.
- CVE-2026-61421 (CVSS 9.8): Dell describes a hard-coded cryptographic key in the archived, unmaintained
karavi-authorizationJWT component. Organizations that followed an old configuration example and have not rotated the signing secret may still be vulnerable to forged administrator tokens. Dell advisory. - CVE-2026-67273 (CVSS 9.6): A low-privileged remote attacker could gain cluster-wide read access to Kubernetes Secrets and tamper with RBAC by exploiting a template-engine issue. Dell advisory.
How to respond
- Inventory your deployments. For each relevant Kubernetes environment, identify installed CSM modules and versions, including Authorization and Operator components.
- Check Dell’s current advisory. Compare the inventory with DSA-2026-448 and the affected-product table. Dell warns that the table may not cover every supported version, so do not infer that an unlisted version is unaffected.
- Upgrade affected deployments. Move to CSM 1.18.0 or later through Dell’s documented release path. Dell recommends upgrading at the earliest opportunity.
- Rotate applicable signing secrets. If the CVE-2026-54472 signing-secret condition applies, rotate JWT signing secrets immediately, following your organization’s change process.
- Verify the result. Confirm the intended CSM release is running and revisit Dell’s advisory for any version-coverage updates.
What Dell has and has not said
Dell lists no workaround or mitigation; the specified remediation is upgrading the CSM software. The signing-secret rotation guidance is specific to the token-signing exposure and does not replace the upgrade. Changing a generic password, patching Dell PCs, or relying solely on a network control is not the fix identified in the advisory.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
- Dell PowerEdge R730xd 24B SFF 2U Server
- 2x Intel Xeon E5-2690 v4 2.6Ghz 14-Core (28-cores Total)
- 128GB DDR4 RAM – 4x 1.2TB 10K SAS 2.5” 12Gb/s
- Dell H730P mini 2GB 12Gb/s RAID
- 2x 750W PSU - 2x 10Gb SFP+ 2x 1Gb (RJ45) NIC
BleepingComputer reported on October 2, 2026, that Dell had not flagged these particular issues as actively exploited. That is a time-bounded report, not a guarantee about later activity. Administrators should check subsequent vendor or government advisories rather than using that status to delay remediation. BleepingComputer’s report.
Quick Recap
Rank #4
- Renewed server with the highest quality standards
- Ideal for a robust enterprise environment or data center
- All servers include power cords, and other parts detailed in full product description below
- Custom configurations available upon request
Rank #3
- Renewed server with the highest quality standards
- Ideal for a robust enterprise environment or data center
- All servers include power cords, and other parts detailed in full product description below
- Custom configurations available upon request
Rank #2
- 3.5 Inch Hot Plug Hard Drive PowerEdge T340 Tower Server Chassis
- Microsoft Windows Server 2019 Standard Operating System
- Processors: Intel Xeon E-2124 Quad-Core 3.3GHz 8MB CPU, Up To 4.3GHz Turbo
- Memory: 32GB (2 x 16GB) DDR4 PC4-21300 2666MHz Unbuffered Memory
- Hard Drive: 8TB (4 x 2TB) 7.2K RPM 6Gb/s SATA 3.5 Inch HDDs in RAID
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.
