CVE-2026-63691: Dell Container Storage Modules Auth Bypass

CVE-2026-63691 Overview

CVE-2026-63691 is a Missing Authorization vulnerability [CWE-862] in Dell Container Storage Modules prior to version 1.18.0. The flaw resides in the Dell Container Storage Interface (CSI) Driver for PowerMax, specifically in the csireverseproxy component. An unauthenticated attacker with adjacent network access can reach the vulnerable component and obtain unauthorized access to resources normally protected by authorization checks. Dell published the issue in security advisory DSA-2026-448. Exploitation requires network adjacency rather than remote internet access, which limits the attacker population to those already on the same logical network segment as the Kubernetes cluster hosting the CSI driver.

Critical Impact

An unauthenticated adjacent attacker can bypass authorization controls in the csireverseproxy component, exposing PowerMax storage proxy functionality to unauthorized operations.

Affected Products

• Dell Container Storage Modules versions prior to 1.18.0
• Dell CSI Driver for PowerMax (csireverseproxy component)
• Kubernetes deployments integrating Dell PowerMax storage via CSM

Discovery Timeline

• 2026-10-06 - CVE CVE-2026-63691 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-63691

Vulnerability Analysis

The csireverseproxy is a sidecar service that brokers requests between the Dell CSI Driver for PowerMax and the PowerMax Unisphere management API. It allows a single Unisphere instance to serve multiple Kubernetes clusters. The missing authorization check means that the proxy accepts requests from clients on the adjacent network without properly validating whether the requester is authorized to perform the requested storage operation. An attacker reaching the proxy endpoint can enumerate or interact with proxied storage API functions. The vulnerability affects confidentiality and availability at a limited scope but changes the security scope because it crosses the trust boundary between the attacker's position and backend storage management.

Root Cause

The root cause is an absent or incomplete authorization enforcement path within the csireverseproxy request handler. Under [CWE-862], the component performs its intended function without first verifying that the requesting principal holds the necessary permissions. The proxy effectively treats network reachability as implicit authorization.

Attack Vector

Exploitation requires adjacent network access to the Kubernetes cluster where the Dell CSI Driver for PowerMax is deployed. No authentication and no user interaction are required. An attacker on the same layer-2 segment, VPC, or cluster network namespace can send crafted requests directly to the csireverseproxy service and receive responses that should have been gated by authorization. Technical details of the request handling path are available in the Dell Security Update DSA-2026-448.

No public proof-of-concept code has been released for this vulnerability. Readers should consult the vendor advisory for component-level technical detail.

Detection Methods for CVE-2026-63691

Indicators of Compromise

• Unexpected inbound connections to the csireverseproxy service port from pods or hosts outside the Dell CSI driver's expected client set
• Unisphere API calls originating from the proxy that do not correlate with legitimate CreateVolume, DeleteVolume, or ControllerPublishVolume operations
• Anomalous storage object enumeration patterns against PowerMax arrays within short time windows

Detection Strategies

• Baseline the normal client set that connects to the csireverseproxy pod and alert on new source IPs or service accounts
• Correlate Kubernetes audit logs with PowerMax Unisphere audit logs to identify storage operations without a matching CSI control-plane request
• Deploy network policies in audit mode first to capture every workload communicating with the CSI driver namespace

Monitoring Recommendations

• Enable verbose logging on csireverseproxy and forward logs to a centralized SIEM for retention and correlation
• Monitor the Dell CSM namespace for pod exec sessions, port-forwards, and lateral movement attempts from adjacent workloads
• Track the version of deployed Dell Container Storage Modules in cluster inventory to confirm patch state across environments

How to Mitigate CVE-2026-63691

Immediate Actions Required

• Upgrade Dell Container Storage Modules to version 1.18.0 or later across all Kubernetes clusters integrating PowerMax
• Inventory every cluster running the Dell CSI Driver for PowerMax and confirm the csireverseproxy image tag
• Restrict network reachability to the csireverseproxy service using Kubernetes NetworkPolicy objects

Patch Information

Dell has released fixed versions in Dell Container Storage Modules 1.18.0. Patch details and download guidance are published in the Dell Security Update DSA-2026-448. Operators should follow Dell's documented CSM upgrade procedure to avoid storage I/O disruption during the rolling update.

Workarounds

• Apply strict NetworkPolicy rules so only the CSI driver pods can reach the csireverseproxy service
• Isolate the CSM namespace on a dedicated network segment with firewall controls blocking adjacent workloads
• Where feasible, scale csireverseproxy to zero until the upgrade is applied, accepting that CSI operations will pause

# Example Kubernetes NetworkPolicy restricting access to csireverseproxy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-csireverseproxy
  namespace: dell-csm
spec:
  podSelector:
    matchLabels:
      app: csireverseproxy
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: csi-powermax
      ports:
        - protocol: TCP
          port: 2222