Critical Dell CSM Flaws Let Attackers Seize Admin Control and Compromise Kubernetes Clusters

Dell has released security updates fixing several critical flaws in its Container Storage Modules (CSM) software, used to manage storage for Kubernetes environments. The most severe issues allow unauthenticated attackers to completely bypass CSM's authorization security model, gaining full administrative control over storage infrastructure across all five supported Dell storage product families and over data belonging to all tenants on a shared system.

Other flaws are equally concerning. One allows an attacker to compromise every node in a Kubernetes cluster through a single malicious submission, while another lets attackers sidestep authentication for the CSM authorization proxy, giving them unauthorized control over storage access policies. A further vulnerability grants cluster-wide read access to Kubernetes Secrets and the ability to create powerful cluster-level permissions, effectively defeating Kubernetes' built-in access controls.

The flaws affect all CSM versions prior to 1.17.0 and are fixed in version 1.18.0. Dell has stated there are no workarounds, meaning the only protection is to update immediately and rotate any JWT signing secrets used by the authorization service. This warning carries extra weight given that other Dell product vulnerabilities have previously been exploited in the wild.