Missing Authentication vulnerability in Dell Container Storage Modules
CVE-2026-63688

10CRITICAL

Key Information:

Vendor

Dell
Status
Dell Container Storage Modules (csm)
Vendor
CVE Published:
6 October 2026

What is CVE-2026-63688?

Dell Container Storage Modules (CSM) versions prior to v1.18.0 contain a vulnerability in the csm-authorization-storage gRPC server, which lacks proper authentication controls. This flaw enables an unauthenticated attacker to gain unauthorized access to critical storage backend administrator credentials across all registered storage arrays. Organizations using vulnerable versions are advised to upgrade to ensure their system's integrity and protect sensitive data.

Affected Version(s)

Dell Container Storage Modules (CSM) 0 < 1.18.0 or later

References

https://www.dell.com/support/kbdoc/en-us/000515771/dsa-20...
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank chwrld for reporting these issues.
.