Database/Control plane, storage & DevOps
Dell Virtual Storage Integrator: unauthenticated disclosure of active session credentials enables admin impersonation
Impact
An unauthenticated remote attacker can obtain active session credentials from VSI and impersonate authenticated users, administrators included. That yields the storage-provisioning authority VSI exposes through vCenter - creating, remapping or deleting datastores that back GPU node boot volumes and dataset stores - without needing any credential of the attacker's own. It is a distinct flaw from the IAPI command injection in the same Dell advisory: no code execution on the appliance, but full use of an administrator's session. Fixed in the same release, so one upgrade closes both.
Who can reach it
Any network client that can reach the VSI web endpoint, typically from the management VLAN. No authentication required.
What to do
Upgrade to Dell Virtual Storage Integrator for VMware vSphere Client 10.11.1.0 or later per DSA-2026-335 - the same upgrade that fixes the IAPI command injection. Restrict network reach to the appliance in the meantime, and invalidate existing VSI sessions after upgrading so any credentials already harvested stop working.
References
Related entries
- Airflow FAB provider: Azure AD login accepted unsigned ID tokens, allowing login as AdminCVE-2026-59243 · Apache Airflow FAB auth manager (Azure AD OAuth ID token validation)Critical
- VMware vCenter (VMware Directory Service authentication bypass): An unauthenticated attacker with network accessCVE-2026-59309 · VMware vCenter (VMware Directory Service authentication bypass)Critical
- VMware vCenter (Syslog server directory traversal to RCE): Directory traversal in the vCenter syslog server lettingCVE-2026-59310 · VMware vCenter (Syslog server directory traversal to RCE)Critical
- Gitea: unauthenticated remote code execution via the diffpatch API installing Git hooksCVE-2026-60004 · Gitea (diffpatch API / Git hook installation)Critical
- JetBrains TeamCity: Deserialization in the agent polling protocolCVE-2026-63077 · JetBrains TeamCityCritical
- Windows iSCSI Target Service (Windows Server 2012 through Windows Server 2025 / Windows 10 1607+): Three heap-basedCVE-2026-65791 · Windows iSCSI Target Service (Windows Server 2012 through Windows Server 2025 / Windows 10 1607+)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.