Description
Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized tenant creation and privilege escalation
Action: Immediate Patch
AI Analysis

Impact

Dell Container Storage Modules before version 1.18.0 are affected by a missing authentication flaw in the TenantService gRPC endpoint. The vulnerability allows an attacker with network proximity to create arbitrary tenant entities, inject cross‑tenant roles, and alter storage access control flags without any credentials, giving them unauthorized control over the storage platform.

Affected Systems

The affected products are Dell Container Storage Modules (CSM) running version 1.17.x and earlier.

Risk and Exploitability

The flaw scores a 7.1 on CVSS, indicating a high impact. EPSS is not available, but the vulnerability is not listed in CISA KEV. The attack vector is likely an unauthenticated adversary on an adjacent or otherwise trusted local network that can reach the gRPC service, making exploitation feasible without initial compromise.

Generated by OpenCVE AI on October 6, 2026 at 18:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Dell Container Storage Modules to version 1.18.0 or higher to apply the official fix for the missing authentication issue.
  • Configure firewall or network segmentation rules to restrict access to the CSM gRPC interface to approved administrative hosts only.
  • Implement monitoring on the container storage modules to detect unauthorized tenant creation or role modification events, and enforce logging for all critical actions.

Generated by OpenCVE AI on October 6, 2026 at 18:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*

Fri, 09 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell container Storage Modules
Vendors & Products Dell
Dell container Storage Modules

Thu, 08 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Tenant Creation and Privilege Escalation via Missing Authentication in Dell Container Storage Modules

Tue, 06 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Dell Container Storage Modules
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-08T17:49:40.651Z

Reserved: 2026-08-04T11:16:10.498Z

Link: CVE-2026-70411

cve-icon Vulnrichment

Updated: 2026-10-08T17:49:36.182Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T16:17:09.877

Modified: 2026-10-20T12:50:06.510

Link: CVE-2026-70411

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:00:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function