CVE-2026-70411: CWE-306: Missing Authentication for Critical Function in Dell Container Storage Modules (CSM)

CVE-2026-70411 describes a Missing Authentication for Critical Function vulnerability in Dell Container Storage Modules (CSM) prior to version 1.18.0. The vulnerability exists in the csm-authorization-tenant gRPC service (TenantService), which does not enforce authentication for critical functions. An attacker on an adjacent network can exploit this to perform unauthorized actions such as creating tenant entities, injecting roles across tenants, and modifying storage access control flags, potentially compromising tenant isolation and access controls.

The vulnerability allows unauthorized attackers without any privileges to manipulate tenant entities and roles, potentially leading to privilege escalation and unauthorized access to storage resources. This can result in compromised tenant isolation and unauthorized modification of storage access controls, impacting confidentiality and integrity of tenant data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Dell's advisories for updates. Until a fix is available, restrict network access to the csm-authorization-tenant gRPC service to trusted entities only to reduce exposure.