CVE-2026-40633: Dell PowerScale OneFS Information Disclosure

CVE-2026-40633 Overview

CVE-2026-40633 is an information disclosure vulnerability in Dell PowerScale OneFS. The flaw involves insertion of sensitive information into log files [CWE-532]. A local attacker with low privileges can read these logs and obtain sensitive data that should not be exposed.

The vulnerability affects Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7 and versions 9.11.0.0 through 9.13.0.2. Dell published the issue in advisory DSA-2026-261.

Critical Impact
Local low-privileged users can harvest sensitive information from OneFS log files, potentially exposing credentials, tokens, or configuration data that enable further attacks against the storage cluster.

Affected Products

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7
Dell PowerScale OneFS versions 9.11.0.0 through 9.13.0.2
Deployments using default logging configuration on affected releases

Discovery Timeline

2026-07-15 - CVE-2026-40633 published to the National Vulnerability Database
2026-07-15 - Dell publishes security advisory DSA-2026-261
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-40633

Vulnerability Analysis

The vulnerability stems from Dell PowerScale OneFS writing sensitive information into log files during normal operation. This mapping to [CWE-532] indicates the software records data that should remain confidential, such as authentication material, session identifiers, or internal configuration values.

Any user account authenticated to the OneFS cluster with permissions to read the affected log files can extract this data. The attack requires local access, meaning the actor must already possess valid credentials or a foothold on the cluster.

Because the vulnerability affects confidentiality only, it does not directly permit modification of data or disruption of service. However, disclosed credentials or tokens can chain into privilege escalation, lateral movement, or unauthorized access to stored data.

Root Cause

OneFS logging routines fail to sanitize or mask sensitive fields before writing entries to disk. Dell has not publicly disclosed the specific log files or data types involved. Refer to the Dell Security Update Advisory for vendor-supplied details.

Attack Vector

An attacker with local access and low privileges reads OneFS log files accessible to their account. The attacker parses log entries for exposed sensitive fields and reuses that information to escalate access or pivot within the environment. No user interaction is required, and the attack complexity is low.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is 0.109%.

Detection Methods for CVE-2026-40633

Indicators of Compromise

Unexpected read access to OneFS log directories by non-administrative accounts
Bulk log file transfers off the cluster by unusual users or hosts
Log ingestion or grep-style queries targeting authentication or session-related log fields
Reuse of credentials or tokens observed in logs from a different source host

Detection Strategies

Audit filesystem access to OneFS log paths and alert on reads by accounts outside the operations team
Correlate authentication events across the cluster to detect reuse of credentials that may have been harvested from logs
Baseline normal log access patterns for administrators and flag deviations
Review OneFS audit configuration to ensure log file access events are captured

Monitoring Recommendations

Forward OneFS audit logs to a central SIEM or data lake for retention and correlation
Monitor privileged and service account activity for anomalous log access
Track SSH and remote management sessions that precede log file reads
Review Dell PowerScale support bundles before sharing externally to confirm sensitive data has been redacted

How to Mitigate CVE-2026-40633

Immediate Actions Required

Apply the fixed release identified in Dell advisory DSA-2026-261 for your OneFS version branch
Restrict local shell and log file access to the minimum set of administrators
Rotate credentials, API keys, and tokens that may have appeared in OneFS logs on affected versions
Review historical log archives and support bundles for sensitive data before further distribution

Patch Information

Dell has released fixed versions for both affected branches. Consult the Dell Security Update Advisory DSA-2026-261 for the exact target versions and upgrade guidance. Upgrade using the standard OneFS rolling upgrade procedure to avoid service disruption.

Workarounds

Limit local login rights on the cluster to administrators with a documented need
Tighten filesystem permissions on OneFS log directories to prevent read access by low-privileged accounts
Sanitize support bundles and log exports before sharing with third parties
Increase log rotation frequency and secure archival storage while planning the upgrade

bash

# Configuration example: restrict shell access and review privileged roles
isi auth roles list
isi auth roles view <RoleName>
# Remove unnecessary members from privileged roles
isi auth roles modify <RoleName> --remove-user=<username>

# Verify OneFS version before and after patching
isi version