An unauthenticated attacker with adjacent network access can exploit a missing authorization check in the Dell CSI Driver for PowerMax – csireverseproxy, allowing unauthorized access to the driver’s interfaces. This can result in undue privilege within the storage module, potentially exposing sensitive storage operations and data. The flaw resides in the driver’s handling of requests without validating client permissions.

Dell Container Storage Modules running any release prior to version 1.18.0 are affected. The vulnerability is specific to the Dell CSI Driver for PowerMax component that manages resource provisioning and access for PowerMax storage systems.

CVE‑2026‑63691 has a CVSS base score of 6.1, indicating moderate severity. EPSS data is unavailable, and the issue is not currently listed in the CISA KEV catalogue. The attack vector is likely local or adjacent network access; an attacker who can reach the CSI Driver’s endpoints from the network can exploit the missing authorization check without authentication. Because it does not require elevated privileges or advanced preparation, the risk of exploitation remains significant for exposed storage clusters.