TI-2026-68459 Aliases CVE-2026-63688 GHSA-hhg3-7qw5-4hq9

Missing authentication in Dell Container Storage Modules gRPC server

MEDIUM 49CWE-306Published 2026-10-06 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a missing authentication flaw (CWE-306) in the csm-authorization-storage gRPC server. An unauthenticated remote attacker can reach a critical function and gain access to storage backend administrator credentials for all registered storage arrays.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00487 42nd percentileScored 2026-11-07

Fix Fixed Dell Container Storage Modules (CSM) (Dell): 1.18.0 or later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Dell Container Storage Modules (CSM)	before 1.18.0 or later	1.18.0 or later	Patch available	CNA

Dell Container Storage Modules (CSM) VendorDell Affected before 1.18.0 or later Fixed in 1.18.0 or later Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:container_storage_modules::::::::	before 1.18.0	Vulnerable	Dell

cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:* Versions before 1.18.0 Vulnerable ·Dell

Remediation

Dell Container Storage Modules (CSM) 1.18.0 or later fixes this flaw. Upgrade affected installations to 1.18.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Dell Container Storage Modules (CSM) (Dell) Fixed in 1.18.0 or later

Timeline

2026-10-06 Threatist record created from CVE-2026-63688
2026-10-06 Alias added: GHSA-hhg3-7qw5-4hq9
2026-10-06 CISA SSVC decision points changed
2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9

TI-2026-68460 Missing authentication in Dell Container Storage Modules CVSS 3.1CRITICAL 10.0
TI-2026-68458 Hard-coded credentials in Dell Container Storage Modules CVSS 3.1CRITICAL 9.8
TI-2026-68457 Hard-coded credentials in Dell Container Storage Modules csm-docs CVSS 3.1CRITICAL 9.8
TI-2022-15325 OS command injection in Dell Container Storage Modules CVSS 3.1HIGH 8.8
TI-2026-68464 Template injection in Dell Container Storage Modules CVSS 3.1CRITICAL 9.6
TI-2026-68461 Privilege escalation in Dell CSM Operator gives root on cluster nodes CVSS 3.1CRITICAL 9.9

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences