The most severe issue is tracked as CVE-2026-63688 and carries a CVSS score of 10.0. It is a missing authentication flaw in the csm-authorization-storage gRPC server, which can be abused to gain unauthenticated administrative access and, in some cases, root on Kubernetes nodes.

Because the source material only lists this single identifier, treat CVE-2026-63688 as the primary reference point when checking your exposure. The vulnerability affects the authorization component of Dell CSM, so clusters running that module should be treated as potentially at risk.

Mitigation guidance:

• Apply the latest Dell CSM security updates as soon as possible.
• Review whether csm-authorization-storage is deployed in your environment.
• Restrict network access to the gRPC endpoint until patching is complete.
• Monitor Kubernetes nodes for unexpected administrative or root-level activity.

If you manage Kubernetes storage in production, prioritize this one. A 10.0 severity rating with unauthenticated access to an admin function is about as urgent as it gets.

Source: The Hacker News

Is your organization running Dell CSM with the authorization module enabled, and if so, how are you handling the patch window?