CVE-2026-28261
Published: 08 April 2026
Summary
CVE-2026-28261 is a high-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Dell Objectscale. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-9 (Protection of Audit Information) and SI-11 (Error Handling).
Deeper analysis
CVE-2026-28261 is an Insertion of Sensitive Information into Log File vulnerability (CWE-532) present in Dell Elastic Cloud Storage version 3.8.1.7 and prior, as well as Dell ObjectScale versions prior to 4.1.0.3 and version 4.2.0.0. This flaw allows sensitive information to be logged, potentially exposing secrets. The vulnerability was published on 2026-04-08 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts under local access conditions.
A low-privileged attacker with local access to the affected systems can exploit this vulnerability by accessing the log files containing the inserted sensitive information. Successful exploitation leads to secret exposure, enabling the attacker to use those secrets to gain access to the vulnerable system with the privileges of the compromised account.
Dell's security advisory DSA-2026-143, detailed at https://www.dell.com/support/kbdoc/en-us/000449325/dsa-2026-143-security-update-for-dell-objectscale-prior-to-4-1-0-3-and-4-2-0-0-insertion-of-sensitive-information-into-log-file-vulnerability, provides security updates addressing this vulnerability in the affected Dell ObjectScale versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20468
Vulnerability details
Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability,…
more
leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system with privileges of the compromised account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly inserts secrets into local log files (CWE-532), enabling adversaries to discover and read insecurely stored credentials via local file access on the system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AU-9 requires protecting audit information from unauthorized access, modification, and deletion, directly preventing low-privileged local attackers from reading sensitive secrets in exposed log files.
SI-11 mandates error handling that avoids disclosing exploitable information, directly addressing the insertion of sensitive data into log files.
SC-4 prevents unauthorized transfer of information via shared system resources like log files accessible to low-privileged users.