{"id":"CVE-2026-63688","published":"2026-10-06T15:17:18.890","lastModified":"2026-10-08T14:15:22.590","description":"Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":["dell"],"products":["container storage modules"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an unauthenticated attacker to gain unauthorized access to storage backend administrator credentials, potentially leading to full control over storage arrays.","exploitability":"Exploitation is relatively easy given the missing authentication for critical functions, requiring only network access to the affected gRPC server.","blast_radius":"If exploited, the impact is high, as it grants full access to all registered storage arrays, compromising data security and integrity.","remediation":"Upgrade to CSM version 1.18.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","storage","grpc","unauthenticated"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:45.674Z"}}