CVE-2026-63690 in Container Storage Modules
Summary
by MITRE • 10/06/2026
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Dell Container Storage Modules (CSM), specifically within versions prior to 1.18.0, exhibit a critical security deficiency characterized by missing authentication for a critical function across the csi-powerflex, csi-powermax, and csi-powerstore components. This vulnerability stems from an architectural oversight where specific API endpoints or internal service interfaces fail to enforce strict identity verification mechanisms before processing requests. In containerized environments utilizing Kubernetes, these storage modules act as intermediaries between orchestration layers and underlying enterprise storage arrays. The absence of authentication allows any entity capable of reaching the network segment hosting these services to interact with sensitive management functions without providing valid credentials or tokens. This flaw fundamentally undermines the principle of least privilege, which dictates that access rights should be granted only to those actually requiring them for their intended purpose.
From a technical perspective, this vulnerability aligns closely with CWE-306, Missing Authentication for Critical Function, and is often associated with CWE-287, Improper Authentication. The affected components likely expose gRPC or HTTP-based interfaces that are designed to handle storage provisioning, snapshot management, or volume attachment operations. Without proper authentication checks, such as validating JSON Web Tokens (JWT), mutual TLS certificates, or Kubernetes service account tokens, the system cannot distinguish between legitimate administrative requests and malicious unauthorized attempts. An attacker positioned on an adjacent network segment can leverage this lack of control to send crafted requests directly to these endpoints. The operational impact is primarily centered around information disclosure, where sensitive configuration data, storage topology details, volume identifiers, and potentially credentials stored within the module's context could be exfiltrated. This exposure provides adversaries with valuable intelligence that facilitates further lateral movement or targeted attacks against the broader infrastructure.
The risk profile of this vulnerability is significantly elevated by its potential for remote exploitation over adjacent networks. Adjacent network access implies that an attacker does not necessarily need to compromise a host directly but can exploit shared network segments, such as VLANs or cloud virtual private clouds (VPCs), where traffic flows freely between compute and storage management planes. This scenario reflects the ATT&CK technique T1078, Valid Accounts, although in this case, it is more accurately described by T1539, Steal Web Session Cookie, if session tokens are leaked, or generally T1213, Data from Information Repositories, as the attacker retrieves structured data about the storage environment. The disclosure of internal storage architecture can aid attackers in mapping out high-value targets within the organization's cloud-native infrastructure, potentially leading to more severe consequences such as denial of service through volume deletion or ransomware deployment if write permissions are also inadvertently exposed due to similar misconfigurations.
To mitigate this vulnerability, organizations must immediately upgrade Dell Container Storage Modules to version 1.18.0 or later, where the authentication mechanisms have been rigorously enforced for all critical functions. In environments where upgrading is not instantly feasible, network segmentation strategies should be implemented to restrict access to the storage module endpoints exclusively from trusted control plane nodes and authorized management interfaces. Utilizing Kubernetes Network Policies can effectively isolate these services from general pod traffic, ensuring that only specific service accounts with verified identities can communicate with the CSI drivers. Additionally, enabling mutual TLS (mTLS) for all inter-service communication adds a layer of cryptographic verification that prevents unauthorized entities from spoofing requests even if they gain network adjacency. Regular auditing of API access logs and implementing strict ingress rules are essential steps to maintain the integrity and confidentiality of containerized storage operations in enterprise deployments.