Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the… (CVE-2026-67269)
Description
Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 contain an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. This vulnerability allows a low privileged remote attacker to escalate privileges and gain root-level access on cluster nodes. The vulnerability is critical with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
CVSS v3.1
Score 9.9critical
Affected software
pkg:github/dell/container-storage-modules-operatorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67269 describes an Improper Privilege Management vulnerability in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0. The flaw exists in the ContainerStorageModule Custom Resource reconciler, which can be exploited by a low privileged remote attacker to escalate privileges to root on cluster nodes. The vulnerability has a CVSS v3.1 score of 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows an attacker with low privileges remote access to escalate to root-level privileges on cluster nodes, potentially compromising the entire cluster's security and control.
Mitigation Recommendations
A fix is available in Dell Container Storage Modules (CSM) Operator version 1.18.0 and later. Users should upgrade to version 1.18.0 or newer to remediate this vulnerability. Since no vendor advisory or patch links are provided, verify the patch status with Dell's official security advisories before applying.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fwc4-f52f-hjhh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67269"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac5236f2cdf04f656c4bf0a
Added to database: 10/06/2026, 16:35:59 UTC
Last enriched: 10/06/2026, 17:04:17 UTC
Last updated: 10/06/2026, 23:48:07 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.