Dell Addresses Critical Security Gaps in Container Storage Modules

Dell Technologies released patches for two maximum-severity vulnerabilities in its Container Storage Modules that could allow unauthenticated attackers to access administrator credentials across all connected storage arrays. The flaws, both rated CVSS 10.0, affect systems managing storage for Kubernetes clusters and also expose additional critical bugs enabling root access and token forgery. No active exploitation has been reported, though the company has urged immediate patching due to the unrestricted nature of the attacks.

Dell's Container Storage Modules serve as a bridge between Kubernetes container systems and enterprise storage platforms, making them a critical point in modern cloud infrastructure. The discovered vulnerabilities bypass foundational security controls—one grants unauthenticated access to administrative credentials across all connected arrays, while another entirely sidesteps login verification. Additionally, separate flaws within the Kubernetes operator and token-generation systems could allow attackers to escalate privileges to root level on cluster nodes.

Dell's advisory reveals concerning gaps in version tracking and disclosure practices, with some patches listed as incomplete and hard-coded credentials appearing across multiple product generations. The company notes that earlier karavi-authorization deployments remain vulnerable since that project is no longer maintained, potentially leaving legacy systems exposed indefinitely.