CVE-2026-28261
Sensitive Information Exposure via Log Injection in Dell ECS and ObjectScale
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | elastic_cloud_storage | to 4.2.0.1 (exc) |
| dell | objectscale | to 4.1.0.3 (exc) |
| dell | objectscale | 4.2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell Elastic Cloud Storage (version 3.8.1.7 and prior) and Dell ObjectScale (versions prior to 4.1.0.3 and version 4.2.0.0). It involves the insertion of sensitive information into log files. A low privileged attacker with local access could exploit this flaw to expose secrets contained in the logs.
By accessing these exposed secrets, the attacker may gain unauthorized access to the vulnerable system with the privileges of the compromised account.
How can this vulnerability impact me? :
The vulnerability can lead to secret exposure, allowing an attacker with local access and low privileges to obtain sensitive information from log files.
Using the exposed secrets, the attacker could escalate their access and operate with the privileges of the compromised account, potentially leading to unauthorized actions, data breaches, or system compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the insertion of sensitive information into log files, which can lead to secret exposure. Such exposure of sensitive data may result in unauthorized access to systems.
Exposure of sensitive information can potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive data from unauthorized access and disclosure.
If exploited, this vulnerability could lead to violations of these standards due to inadequate protection of sensitive information, increasing the risk of data breaches and non-compliance penalties.