Description

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-06T15:17:19.130Z",
  "pubdate": "2026-10-06T15:17:19.130Z",
  "executiveSummary": "Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 are susceptible to an improper privilege management vulnerability located within the ContainerStorageModule Custom Resource (CR) reconciler.\nThis security flaw allows a remote attacker with low-level privileges within the Kubernetes cluster to exploit the reconciler's logic, facilitating privilege escalation to achieve root-level execution on the underlying cluster nodes.\nThe vulnerability represents a significant risk to cluster integrity, as unauthorized root access provides an attacker with complete control over the affected node, potentially leading to container breakout, sensitive data exfiltration, and lateral movement across the infrastructure.\nThe exploitation does not require advanced administrative credentials, only the ability to interact with the cluster API to create or modify specific Custom Resources.\nOrganizations utilizing affected versions are at high risk of node-level compromise and should prioritize upgrading to the patched release to mitigate this escalation vector.",
  "technicalDetails": "The vulnerability resides within the ContainerStorageModule Custom Resource reconciler, a core component of the Dell CSM Operator responsible for orchestrating storage module lifecycles, configuration, and state synchronization within a Kubernetes environment.\nThe root cause is identified as an Improper Privilege Management flaw, wherein the reconciler fails to enforce strict security boundaries or validate the configuration parameters supplied within the ContainerStorageModule CR.\nIn a standard Kubernetes deployment, the CSM Operator operates with elevated privileges, typically via a ClusterRole, to manage storage infrastructure. The vulnerability occurs because the reconciler performs operations with these elevated permissions without sufficient input sanitization or context isolation when processing user-defined resource specifications.\nAn attacker with limited cluster access—who would otherwise be restricted by Kubernetes Role-Based Access Control (RBAC)—can craft a malicious ContainerStorageModule CR. By injecting specific configurations into the CR fields that the reconciler processes, the attacker can coerce the operator into performing unauthorized actions on the host node.\nThe attack flow proceeds as follows: First, the attacker identifies the ability to define or modify a ContainerStorageModule resource. Second, the attacker embeds a payload within the CR specification that targets the reconciler’s execution logic. Third, upon reconciliation, the operator interprets this malicious configuration. Finally, because the operator functions with high-level authority, the system interprets the attacker's instructions as legitimate management commands, executing them on the host operating system.\nThis execution context allows the attacker to bypass container isolation primitives, gaining root-level privileges on the worker node. Once root access is achieved, the attacker can manipulate node-level processes, intercept sensitive traffic, gain access to persistent volume data, or modify node security configurations to ensure persistence.\nThe impact of this vulnerability is severe, as it transforms a low-privileged cluster user into a root-level attacker. The scope is limited to cluster nodes where the CSM Operator manages storage modules, but given the critical nature of storage infrastructure, this often encompasses the majority of the worker nodes in a production storage-aware cluster.\nAffected versions are strictly limited to those preceding 1.18.0. There is no requirement for the attacker to have pre-existing administrative access; however, the ability to create or edit Custom Resources within the relevant namespaces is a necessary prerequisite for exploitation."
}