CVE-2026-40711: Dell Container Storage Modules RCE Flaw

CVE-2026-40711 Overview

CVE-2026-40711 is an OS Command Injection vulnerability [CWE-78] affecting multiple Dell Container Storage Modules (CSM). The flaw exists in the Container Storage Interface (CSI) drivers for Dell storage platforms, including csi-powerstore, csi-unity, csi-powerflex, and csi-powermax, all at version 2.16.0. An attacker with high privileges and remote access can inject arbitrary operating system commands. Successful exploitation results in command execution in the context of the affected module, with a scope change that can impact resources beyond the vulnerable component.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands on Kubernetes nodes running Dell CSI storage drivers, compromising container orchestration and backend storage integrity.

Affected Products

Dell Container Storage Modules csi-powerstore v2.16.0
Dell Container Storage Modules csi-unity v2.16.0
Dell Container Storage Modules csi-powerflex v2.16.0 and csi-powermax v2.16.0

Discovery Timeline

2026-06-26 - CVE-2026-40711 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-40711

Vulnerability Analysis

CVE-2026-40711 stems from improper neutralization of special elements passed to an operating system command interpreter within Dell Container Storage Modules. The Container Storage Interface (CSI) drivers translate Kubernetes storage requests into operations on Dell storage arrays. When user-controllable input is incorporated into shell commands without adequate sanitization, an attacker can append or inject additional commands using metacharacters such as ;, |, &&, or backticks. Execution occurs in the context of the CSI controller or node plugin, typically privileged workloads within a Kubernetes cluster.

Root Cause

The root cause is a failure to properly neutralize special shell metacharacters before passing input into an OS command context, classified under [CWE-78]. Affected CSI drivers construct command strings from parameters supplied through the storage management workflow. Without strict allow-listing or safe API invocation, attacker-controlled data reaches a shell for interpretation.

Attack Vector

Exploitation requires network access to the affected CSI module and high privileges within the environment, such as a compromised administrative account with rights to submit storage operations. The scope is changed, meaning the injected command can affect resources beyond the vulnerable component, including the host node, adjacent pods, and backend storage. No user interaction is required. Because the CSI controller typically runs with elevated Kubernetes service account privileges, command execution can pivot into cluster-wide compromise.

Refer to the Dell Security Update DSA-2026-259 for technical specifics on the vulnerable code paths.

Detection Methods for CVE-2026-40711

Indicators of Compromise

Unexpected child processes spawned by CSI driver pods (csi-powerstore, csi-unity, csi-powerflex, csi-powermax) such as sh, bash, curl, wget, or nc.
Outbound network connections originating from CSI controller or node plugin containers to untrusted destinations.
Kubernetes audit log entries showing anomalous CreateVolume, ControllerPublishVolume, or NodeStageVolume calls containing shell metacharacters in parameters.

Detection Strategies

Monitor Kubernetes audit logs for CSI API requests containing suspicious characters (;, |, &, `, $() in volume names, snapshot names, or storage class parameters.
Baseline the expected process tree of CSI driver pods and alert on deviations, particularly interactive shell or scripting interpreter execution.
Inspect container runtime telemetry for exec events into CSI pods that do not originate from legitimate operators.

Monitoring Recommendations

Enable Kubernetes API server audit logging at the RequestResponse level for storage-related resources.
Aggregate container runtime and node-level process telemetry into a centralized SIEM for correlation across the cluster.
Alert on privileged CSI pod egress traffic to non-storage endpoints, which may indicate post-exploitation command-and-control.

How to Mitigate CVE-2026-40711

Immediate Actions Required

Upgrade all affected Dell Container Storage Modules beyond version 2.16.0 per Dell Security Advisory DSA-2026-259.
Audit and reduce the number of accounts with high privileges capable of invoking CSI operations against the cluster.
Review recent Kubernetes audit logs for anomalous storage API activity that predates patch deployment.

Patch Information

Dell has published remediation guidance in Dell Security Update DSA-2026-259. Administrators should upgrade csi-powerstore, csi-unity, csi-powerflex, and csi-powermax to the fixed release specified in the advisory.

Workarounds

Restrict RBAC permissions so only trusted service accounts can create or modify StorageClass, PersistentVolumeClaim, and VolumeSnapshot resources.
Apply Kubernetes admission controllers (such as OPA/Gatekeeper or Kyverno) to reject storage resource specifications containing shell metacharacters in string fields.
Enforce network policies limiting egress from CSI driver pods to only the required storage management endpoints.

bash

# Example Kyverno policy fragment to block shell metacharacters in PVC names
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-csi-metachars
spec:
  validationFailureAction: Enforce
  rules:
    - name: no-shell-metachars-in-pvc
      match:
        any:
          - resources:
              kinds:
                - PersistentVolumeClaim
                - VolumeSnapshot
      validate:
        message: "Shell metacharacters are not permitted in storage resource names."
        pattern:
          metadata:
            name: "!*[;|&`$()]*"