Authentication bypass in NetApp StorageGRID
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
NetApp StorageGRID (formerly StorageGRID Webscale) versions from 11.3 before 11.9.0.15, 12.0.0.9, 12.1.0.1 are affected. An authentication bypass through an alternate path or channel (CWE-288) lets a remote attacker who has product-specific knowledge and can reach the Grid Network on certain ports make unauthorized requests. The attacker needs no privileges or user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetApp | StorageGRID (formerly StorageGRID Webscale) | 11.3 to before 11.9.0.15, 12.0.0.9, 12.1.0.1 | 11.9.0.15, 12.0.0.9, 12.1.0.1 | Patch available | CNA |
- StorageGRID (formerly StorageGRID Webscale) VendorNetApp Affected 11.3 to before 11.9.0.15, 12.0.0.9, 12.1.0.1 Fixed in 11.9.0.15, 12.0.0.9, 12.1.0.1 Patch available CNA
Remediation
Upgrade StorageGRID to version 11.9.0.15, 12.0.0.9 or 12.1.0.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA StorageGRID (formerly StorageGRID Webscale) (NETAPP) Fixed in 11.9.0.15, 12.0.0.9, 12.1.0.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NETAPP StorageGRID (formerly StorageGRID Webscale) 11.9.0.15, 12.0.0.9, 12.1.0.1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-84811 Authentication bypass in NetApp StorageGRID exposes grid-only APIsPriority LOW 36
Timeline
- 2026-11-03 Threatist record created from CVE-2026-22058
- 2026-11-04 Alias added: GHSA-h4vc-x53f-c73h
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: MEDIUM → LOW
- 2026-11-05 Priority changed: LOW → MEDIUM
- 2026-11-05 Weakness changed · CISA ADP
References
More NetApp vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-36205 Redfish Authentication Bypass KEVCVSS 4.0CRITICAL 10.0
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-22058 · CVE Program
- CVE-2026-22058 · NVD
- FIRST EPSS
- GHSA-h4vc-x53f-c73h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences