TI-2026-22573 Aliases CVE-2026-28261 GHSA-j4mw-2jfj-wq9h

Sensitive information in log files in Dell Elastic Cloud Storage

LOW 35CWE-532Published 2026-04-08 · Updated 2026-04-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system with privileges of the compromised account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00109 1st percentileScored 2026-11-07

Fix Fixed Elastic Cloud Storage (Dell): 4.2.0.1 or laterObjectScale (Dell): 4.1.0.3, 4.2.0.1 or later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Elastic Cloud Storage	before 4.2.0.1 or later	4.2.0.1 or later	Patch available	CNA
Dell	ObjectScale	before 4.1.0.3; before 4.2.0.1 or later	4.1.0.3, 4.2.0.1 or later	Patch available	CNA

Elastic Cloud Storage VendorDell Affected before 4.2.0.1 or later Fixed in 4.2.0.1 or later Patch available CNA
ObjectScale VendorDell Affected before 4.1.0.3; before 4.2.0.1 or later Fixed in 4.1.0.3, 4.2.0.1 or later Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:elastic_cloud_storage::::::::	before 4.2.0.1	Vulnerable	Dell
cpe:2.3:a:dell:objectscale::::::::	before 4.1.0.3	Vulnerable	Dell
cpe:2.3:a:dell:objectscale:4.2.0.0:::::::*	4.2.0.0	Vulnerable	Dell

cpe:2.3:a:dell:elastic_cloud_storage:*:*:*:*:*:*:*:* Versions before 4.2.0.1 Vulnerable ·Dell
cpe:2.3:a:dell:objectscale:*:*:*:*:*:*:*:* Versions before 4.1.0.3 Vulnerable ·Dell
cpe:2.3:a:dell:objectscale:4.2.0.0:*:*:*:*:*:*:* Versions 4.2.0.0 Vulnerable ·Dell

Remediation

Fix · CNA Elastic Cloud Storage (Dell) Fixed in 4.2.0.1 or later
Fix · CNA ObjectScale (Dell) Fixed in 4.1.0.3, 4.2.0.1 or later

Timeline

2026-10-02 Threatist record created from CVE-2026-28261
2026-10-03 Alias added: GHSA-j4mw-2jfj-wq9h

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000449325/dsa-2026-143-security-update-for-dell-objectscale-prior-to-4-1-0-3-and-4-2-0-0-insertion-of-sensitive-information-into-log-file-vulnerability

TI-2026-29362 Hard-coded credentials in Dell ECS CVSS 3.1CRITICAL 9.8
TI-2017-05618 EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account… CVSS 3.1CRITICAL 9.8
TI-2026-27313 CSV injection in Dell ECS CVSS 3.1CRITICAL 9.8
TI-2026-17882 Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to… CVSS 3.1HIGH 8.8
TI-2025-19424 Improper input validation in Dell ECS CVSS 3.1HIGH 8.8
TI-2023-11182 Improper signature verification in Dell ECS CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences