An improper privilege management flaw exists in the ContainerStorageModule Custom Resource reconciler within Dell Container Storage Modules (CSM) Operator versions earlier than 1.18.0. This flaw permits a low‑privileged remote attacker who can submit custom resources to the Kubernetes cluster to gain privileged access, eventually allowing them to execute arbitrary code as root on the underlying cluster nodes. The denial of appropriate access controls leads to a severe compromise of confidentiality, integrity, and availability of the entire data‑storage environment.

Dell Container Storage Modules, the operator responsible for managing storage resources in Kubernetes, is affected when deployed in any configuration before version 1.18.0. The vulnerability is tied to the reconciler component that processes custom resource definitions. Monitoring your installation's operator version and ensuring it conforms to the latest release is essential for protecting the cluster.

The CVSS score of 9.9 underscores the critical nature of this flaw, and while the EPSS metric is not currently available, the lack of a listed KEV status does not diminish the urgency of remediation. A low‑privileged remote attacker with access to the cluster orchestration layer can exploit the reconciliation failure; thus, the attack vector is fully remote within the cluster environment. The analysis indicates that gaining root-level access on nodes provides an attacker with complete control over the storage infrastructure, making this flaw a high‑risk vulnerability that demands immediate response.