CVE-2026-67269

Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 contain an improper privilege management vulnerability (CWE-269) in the ContainerStorageModule Custom Resource reconciler. A remote attacker with only low-privileged access to the Kubernetes cluster could exploit the flaw through the reconciler's handling of the ContainerStorageModule custom resource, escalating privileges and gaining root-level access on cluster nodes. This affects Kubernetes clusters where the Dell CSM Operator is deployed to manage Dell storage integrations. The issue carries a critical CVSS 3.1 score of 9.9 and was part of a broader batch of 18 critical Dell CSM flaws for which Dell has urged admins to patch immediately. No public proof of concept exists and the vulnerability is not known to be exploited in the wild, but the impact potential makes prompt patching essential.

What to do: Upgrade the Dell CSM Operator to version 1.18.0 or later as soon as possible. As an interim mitigation, tighten Kubernetes RBAC so that only trusted principals can create or modify the ContainerStorageModule custom resource, and audit recent changes to that CR and reconciler logs for unauthorized activity. Review cluster nodes for signs of root-level compromise (unexpected processes, containers with node-level privileges, or modified kubelet/container runtime configuration).