CVE-2026-54472 is a critical severity (CVSS 9.8) hard-coded credentials flaw in Dell Container Storage Modules. Versions before 1.18.0 carry the issue in csm-docs, and an unauthenticated remote attacker could obtain information. Update to 1.18.0 or later. The steps below show how to check your version and what to change.
What's affected
- Dell Container Storage Modules: versions before 1.18.0, per the record. The affected component is
csm-docs.
The record describes the impact as information disclosure by an unauthenticated attacker with remote access, with a base score of 9.8 (Critical).
Dell's advisory DSA-2026-448 covers this and other issues in Container Storage Modules. The advisory page refused automated access when I tried to read it, so I could not confirm Dell's own wording, fix list or other affected versions. Read it directly before you finalize your plan.
How to check if you're exposed
Find the Container Storage Modules version you deploy. In Kubernetes, look at the images and chart versions for the CSM components:
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i dell
Compare the tags with 1.18.0 and with the version table in Dell's advisory. Also check whether csm-docs is deployed or reachable at all. A documentation component that is exposed outside the cluster raises the urgency.
What to do now
- Read Dell advisory DSA-2026-448 and confirm the fixed version for your release.
- Update Container Storage Modules to 1.18.0 or later.
- Check whether csm-docs is exposed through an ingress or service reachable from outside, and restrict it.
- Rotate any credentials that could have been exposed by the affected component, as a precaution.
- Review access logs for the documentation endpoint if it was reachable.
Why it matters
The record lists CWE-798, use of hard-coded credentials. A credential built into software is the same for every installation, so anyone who finds it can use it. Removing it needs a new release, because operators cannot change a value compiled into the product.
The score is Critical because the record says no authentication is needed and the access is remote. The record does not mark this CVE as known exploited, and I found no exploitation statement in the sources I could read.
Quick check
Why can't I just change the password?
A hard-coded credential is built into the software and is the same everywhere. It has to be removed by a release, not changed in configuration.
Did you confirm the fix with Dell?
No. The advisory page blocked automated access. The 1.18.0 boundary comes from the record, so confirm it in Dell's advisory.
Sources
Last reviewed: 18 October 2026.
