Elastic Cloud Storage CVE-2026-28261

Requires local access to Dell Elastic Cloud Storage (versions ≤3.8.1.7) or Dell ObjectScale (versions <4.1.0.3 or 4.2.0.0). Attacker must be a low-privileged local user who can read log files containing exposed secrets to escalate privileges.

The CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact (C:H/I:H/A:H), but the local attack vector (AV:L) and low privilege requirement (PR:L) significantly constrain real-world exploitation scenarios. This is not a remotely exploitable vulnerability-attackers must first obtain authenticated local access to affected systems, which limits exposure compared to network-based attacks. The low attack complexity (AC:L) indicates exploitation is straightforward once local access is achieved, requiring only standard file system access to logs. No EPSS score is provided, but historical data for CWE-532 vulnerabilities suggests exploitation probability remains moderate because attackers must already have compromised the perimeter. CISA KEV status is not indicated, confirming no evidence of active exploitation in the wild. The SSVC decision framework would classify this as 'Scheduled' priority rather than immediate: exploitation requires existing authenticated access (not automatable from external networks), technical impact is credential disclosure (not direct RCE), and no public POC exists. Primary risk exists in environments with weak internal access controls, shared administrative credentials, or inadequate log file permissions where low-privileged users can access diagnostic outputs. Organizations with robust least-privilege models and log access controls face materially lower risk despite the high CVSS score.

An attacker with low-privileged local access to a Dell ObjectScale management node-such as a junior DevOps engineer, support contractor, or compromised service account-navigates to the application log directory (/var/log/objectscale/ or similar) and reads diagnostic logs containing plaintext administrative credentials logged during authentication failures or configuration changes. Using the extracted credentials, the attacker authenticates to the ObjectScale management API or storage cluster with elevated privileges, enabling data exfiltration, configuration tampering, or deployment of persistent backdoors. In multi-tenant cloud environments, this could allow lateral movement from a compromised tenant's low-privilege shell access to full administrative control of the shared storage infrastructure.