Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the… (CVE-2026-70411)

CVE-2026-70411 describes a Missing Authentication for Critical Function vulnerability in Dell Container Storage Modules (CSM) prior to version 1.18.0. The flaw exists in the csm-authorization-tenant gRPC service (TenantService), where an unauthenticated attacker on an adjacent network can exploit the lack of authentication to create tenant entities, inject roles across tenants, and alter storage access control flags. This vulnerability compromises integrity and confidentiality but does not impact availability. The CVSS v3.1 base score is 7.1, reflecting low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker on an adjacent network can exploit this vulnerability to perform unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags. This could lead to unauthorized access and privilege escalation within the affected system. The impact affects confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Dell's advisories for updates. Until a patch is available, restrict network access to the csm-authorization-tenant gRPC service to trusted hosts only to reduce exposure.