EUVD-2026-20468Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system with privileges of the compromised account.
AnalysisAI
Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenticated users with low privileges to extract credentials from log files and escalate to compromised account privileges. CVSS 7.8 (High). No public exploit identified at time of analysis. EPSS data not available, but local access requirement and low attack complexity suggest moderate exploitation likelihood in multi-tenant or shared administrative environments.
Technical ContextAI
This vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), a common logging misconfiguration where applications write authentication credentials, API tokens, or cryptographic secrets to diagnostic logs in cleartext or insufficiently protected formats. Dell Elastic Cloud Storage and ObjectScale are enterprise object storage platforms designed for petabyte-scale unstructured data management, often deployed in multi-tenant cloud infrastructures. The affected CPE strings (cpe:2.3:a:dell:elastic_cloud_storage and cpe:2.3:a:dell:objectscale) indicate both standalone ECS appliances and containerized ObjectScale deployments are vulnerable. The CVSS vector (AV:L/AC:L/PR:L) confirms exploitation requires local system access with low-privileged credentials, typical in environments where multiple administrators, DevOps engineers, or support personnel share access to storage management interfaces or underlying operating systems. Attackers gaining access to log files-via misconfigured file permissions, backup archives, or log aggregation systems-can extract valid credentials and authenticate as higher-privileged accounts without triggering audit alarms.
RemediationAI
Vendor-released patches: Upgrade Dell Elastic Cloud Storage to version 3.8.1.8 or later (specific fixed version not enumerated in advisory but implied by 'prior to 3.8.1.7' vulnerability scope). For Dell ObjectScale, upgrade to version 4.1.0.3 or later for the 4.1.x branch, or migrate from vulnerable 4.2.0.0 to a patched 4.2.x release when available (Dell advisory DSA-2026-143 does not specify 4.2.x fixed version, suggesting 4.2.0.0 users should downgrade to patched 4.1.0.3+ until 4.2.x patch release). Interim mitigations: Implement strict file system permissions on log directories to prevent access by low-privileged users (chmod 700 on log paths, restrict to root/admin accounts only). Rotate all credentials that may have been logged prior to patching, including API tokens, service account passwords, and administrative credentials. Enable log encryption at rest and sanitize existing log archives. Review log aggregation and SIEM configurations to ensure forwarded logs do not expose secrets to broader audiences. Full technical guidance available in Dell Security Advisory DSA-2026-143: https://www.dell.com/support/kbdoc/en-us/000449325/dsa-2026-143-security-update-for-dell-objectscale-prior-to-4-1-0-3-and-4-2-0-0-insertion-of-sensitive-information-into-log-file-vulnerability.
More in Elastic Cloud Storage
View allEMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially b
Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. Rated critical severity (CVSS
Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentia
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. Rated high severit
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ECS, versions prior to 3.8.1.3 contains an arithmetic overflow vulnerability exists in retention period handling of
Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. Rated medium severity
Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper a
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext storage of sensitive information (CVSS 5.5).
Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. Rated me
Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. Rated medium severity (CVSS 4.3),
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today