Dell Container Storage Modules (CSM) contain a missing authentication flaw in the csm-authorization-storage gRPC server, allowing an unauthenticated remote attacker to obtain the administrator credentials for all registered storage arrays. The vulnerability is a critical function exposure: any external host can call the gRPC endpoint and retrieve sensitive credentials without providing credentials or passing through any authentication checks. This exposes the cluster to full administrative compromise, enabling an attacker to manage, delete or exfiltrate data, and potentially pivot to other systems.

The affected product is Dell Container Storage Modules (CSM) versions earlier than 1.18.0. Systems running any pre‑1.18.0 release are at risk if they expose the csm-authorization-storage gRPC service to external networks.

The CVSS score of 10 indicates the highest possible severity, reflecting the impact of full administrator access. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of authentication and remote nature of the attack vector make exploitation highly likely for an attacker with network reachability. An attacker who exploits this flaw can gain credentials to the storage backend, enabling complete control over all storage arrays owned by the system.