Dell clarifies CSM
Updated 16 October 2026. Dell resolved the conflict on 5 October: CSM before 1.18.0 is affected, 1.18.0 onwards remediated, including CVE-2026-76105. A drivers link followed on 6 October.
Critical entries
Missing authentication exposes storage-administrator credentials in CVE-2026-63688 or elevates privileges in CVE-2026-63692, initially described as cross-tenant administration. CVE-2026-67269 permits low-privileged node-root access; CVE-2026-67273, privilege escalation, initially described as Kubernetes Secrets access and cluster-wide RBAC changes.
Current descriptions concern embedded credentials: csm-docs information disclosure (CVE-2026-54472) and CSM Authorization privilege escalation (CVE-2026-61421). The 1 October text warned of forged administrator tokens, immediate JWT signing-secret rotation for the former, and the latter’s archived karavi-authorization project and removed guide’s secret and live token.
Dell does not report exploitation. Omissions prove neither rescission nor continued exposure.
Approval is not completion
For a hypothetical change review, keep the authorisation, completion note and acceptance decision distinguishable. Permission to do work is not evidence that it finished. BlackTree proposes retaining that dated chain, not rewriting an old request to make it look current. This is a record-keeping method, not a vendor requirement or a claim that we tested a package or found an installation clean.
