CVE-2026-63688

Analyzed Analyzed - Analysis Complete

Dell CSM Missing Authentication for Critical Function

Publication date: 2026-10-06

Last updated on: 2026-10-08

Assigner: Dell

Description

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63688

EUVD

EUVD-2026-93428

Affected Vendors & Products

Vendor	Product	Version / Range
dell	container_storage_modules	to 1.18.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Dell Container Storage Modules (CSM) before version 1.18.0 has a vulnerability where the csm-authorization-storage gRPC server lacks authentication. This allows an unauthenticated remote attacker to access storage backend administrator credentials for all registered storage arrays.

Detection Guidance

To detect this vulnerability, check if Dell CSM versions prior to v1.18.0 are running on your system. Verify the csm-authorization-storage gRPC server is exposed without authentication. Inspect network traffic for unauthorized access attempts to storage backend credentials.

Impact Analysis

An attacker could gain unauthorized access to sensitive storage backend credentials, potentially leading to data breaches, unauthorized data manipulation, or disruption of storage services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and security such as GDPR and HIPAA, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Dell Container Storage Modules (CSM) to version v1.18.0 or later to address the Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server.

Hi! I’m here to help you understand CVE-2026-63688. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70