CVE-2026-67273

Dell Container Storage Modules before 1.18.0 fail to neutralize special elements in a template engine (CWE-1336), a template-injection flaw. A remote attacker who already has low privileges can trigger it over the network with low complexity and no user interaction. Because the scope changes, the impact extends beyond the vulnerable component, with high confidentiality and integrity impact and no availability impact stated in the CVSS vector (9.6 critical), resulting in privilege escalation. Sites running Dell CSM for container storage on Kubernetes are affected if they have not moved to 1.18.0. No public proof of concept is known and the issue is not in CISA KEV, so exploitation in the wild is not known; related reporting urges prompt patching of critical CSM flaws.

What to do: Upgrade Dell Container Storage Modules to version 1.18.0 or later. Until that is done, limit network access to CSM interfaces to trusted administrators and review low-privilege accounts that can reach the template features.