Read the docs
TI-2026-70151 Aliases CVE-2026-22061GHSA-h9gv-qj3w-x5ff

Debug log exposure in NetApp Trident leaks LUKS and SMB credentials

Priority LOW 34CWE-215Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

NetApp Trident versions from v25.02.1 through v26.06.1 are affected. The product places sensitive information into debug code (CWE-215), so the debug logs expose it. An authenticated attacker who can access debug logs could view LUKS passphrases or SMB Active Directory credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00113 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetAppTridentv25.02.1 – v26.06.1—No fix listedCNA
  • Trident VendorNetApp Affected v25.02.1 – v26.06.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for NetApp Trident.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-22061
  2. 2026-10-10 Alias added: GHSA-h9gv-qj3w-x5ff
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-13 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-36205 Redfish Authentication Bypass KEVCVSS 4.0CRITICAL 10.0
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
See all 2527 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences