CVE-2026-61411

Dell Container Storage Modules versions prior to 1.18.0 contain a Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could exploit it, leading to information tampering.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could create unauthorized tenant entities, inject cross-tenant roles, and modify storage access control flags.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could exploit it, leading to exposure of storage backend administrator credentials.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell Container Storage Modules prior to version 1.18.0 contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in CSM Authorization. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in csm-docs. An unauthenticated attacker with remote access could exploit this vulnerability to disclose information.