A Storage Update Still Needs Its Boundary Test
Updated 20 October 2026. Dell resolved the conflict on 5 October: CSM before 1.18.0 is affected, 1.18.0 onwards remediated, including CVE-2026-76105. A drivers link followed on 6 October.
The most severe faults
Absent login checks can reveal credentials for storage administrators in CVE-2026-63688 or confer greater access in CVE-2026-63692, initially described as cross-tenant administration. CVE-2026-67269 can make an account with limited rights a node’s superuser. CVE-2026-67273 can broaden permissions; the initial text described exposing Kubernetes Secrets, alongside changes to RBAC throughout the cluster.
Current descriptions concern embedded credentials enabling unauthorised reading through csm-docs (CVE-2026-54472) and greater access through the authorisation module (CVE-2026-61421). The 1 October text warned that administrator tokens could be forged. For the former, it advised replacing the material used to sign JWTs immediately. For the latter, it identified the archived karavi-authorization project and a removed guide that contained a sensitive value and a live token.
The advisory gives no exploitation assessment. Omissions prove neither rescission nor continued exposure.
Test the access boundary
BlackTree’s operational approach is to retain the deployed package, the maintenance result and the permission-test evidence as separate records. In a test environment, use an authorised non-administrator account for one operation it should be allowed to perform and one it should be denied. An installation receipt cannot demonstrate that boundary. Keep the observed result and the responsible owner’s acceptance before widening the rollout.
