Dell CSM Authorization Storage gRPC Server Missing Authentication — Unauthenticated Admin Credential…

#!/usr/bin/env bash
# check_csm_cve_2026_63688.sh
# Checks whether Dell CSM Authorization is vulnerable to CVE-2026-63688
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

# Adjust namespace if your CSM deployment uses a different one
CSM_NAMESPACES=("dell-csm" "authorization" "csm-authorization" "dell-csm-operator")
FIXED_VERSION="1.18.0"
FOUND=false

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

echo "[*] CVE-2026-63688 — Dell CSM Authorization Storage gRPC Missing Authentication"
echo "[*] Fixed in CSM >= ${FIXED_VERSION}"
echo ""

# Check kubectl connectivity
if ! kubectl cluster-info &>/dev/null; then
  echo "[!] Cannot connect to Kubernetes cluster."
  echo "UNKNOWN"
  exit 2
fi

for NS in "${CSM_NAMESPACES[@]}"; do
  # Check if namespace exists
  if ! kubectl get namespace "$NS" &>/dev/null; then
    continue
  fi

  # Look for CSM authorization-related deployments
  DEPLOYS=$(kubectl get deployments -n "$NS" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .spec.template.spec.containers[*]}{.image}{" "}{end}{"\n"}{end}' 2>/dev/null || true)

  if [ -z "$DEPLOYS" ]; then
    continue
  fi

  while IFS=$'\t' read -r DEPLOY_NAME IMAGES; do
    # Match CSM authorization images
    if echo "$IMAGES" | grep -qiE 'csm-authorization|dell/csm'; then
      FOUND=true
      echo "[*] Found CSM deployment: $DEPLOY_NAME in namespace $NS"
      for IMG in $IMAGES; do
        if echo "$IMG" | grep -qiE 'csm-authorization|dell/csm'; then
          # Extract version tag
          TAG=$(echo "$IMG" | grep -oE ':[^:]+$' | tr -d ':' || echo "unknown")
          echo "[*] Image: $IMG"
          echo "[*] Detected version tag: $TAG"

          # Clean version string (remove leading v)
          CLEAN_TAG=$(echo "$TAG" | sed 's/^v//')

          # Check if it looks like a version
          if echo "$CLEAN_TAG" | grep -qE '^[0-9]+\.[0-9]+'; then
            if version_gte "$CLEAN_TAG" "$FIXED_VERSION"; then
              echo ""
              echo "PATCHED — CSM version $CLEAN_TAG >= $FIXED_VERSION"
              exit 0
            else
              echo ""
              echo "VULNERABLE — CSM version $CLEAN_TAG < $FIXED_VERSION"
              echo "[!] Upgrade to CSM $FIXED_VERSION immediately."
              echo "[!] Post-patch: rotate JWT secrets and all storage-array admin passwords."
              exit 1
            fi
          else
            echo "[!] Could not parse version from tag: $TAG"
          fi
        fi
      done
    fi
  done <<< "$DEPLOYS"
done

if [ "$FOUND" = false ]; then
  echo "[*] No Dell CSM Authorization deployment found in checked namespaces."
  echo "[*] Checked: ${CSM_NAMESPACES[*]}"
  echo "[*] If CSM is deployed in a custom namespace, set CSM_NAMESPACES."
  echo ""
  echo "UNKNOWN"
  exit 2
fi

echo ""
echo "UNKNOWN — Found CSM artifacts but could not determine version."
exit 2