Authentication bypass in NetApp StorageGRID exposes grid-only APIs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
NetApp StorageGRID (formerly StorageGRID Webscale) versions from 0 before 11.9.0.15, 12.0.0.9, 12.1.0.1 are affected in default and common configurations. An unauthenticated remote attacker can reach a limited set of APIs that are intended only for use within the grid, because of an authentication bypass through an alternate path or channel (CWE-288). The CVSS 4.0 vector shows low confidentiality and integrity impact with no availability impact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetApp | StorageGRID (formerly StorageGRID Webscale) | before 11.9.0.15, 12.0.0.9, 12.1.0.1 | 11.9.0.15, 12.0.0.9, 12.1.0.1 | Patch available | CNA |
- StorageGRID (formerly StorageGRID Webscale) VendorNetApp Affected before 11.9.0.15, 12.0.0.9, 12.1.0.1 Fixed in 11.9.0.15, 12.0.0.9, 12.1.0.1 Patch available CNA
Remediation
Upgrade StorageGRID to 11.9.0.15, 12.0.0.9 or 12.1.0.1, which are the fixed versions listed for this product.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA StorageGRID (formerly StorageGRID Webscale) (NETAPP) Fixed in 11.9.0.15, 12.0.0.9, 12.1.0.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NETAPP StorageGRID (formerly StorageGRID Webscale) 11.9.0.15, 12.0.0.9, 12.1.0.1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-84807 Authentication bypass in NetApp StorageGRIDPriority MEDIUM 41
Timeline
- 2026-11-03 Threatist record created from CVE-2026-22060
- 2026-11-04 Alias added: GHSA-wrhp-xhf3-wvm3
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: MEDIUM → LOW
- 2026-11-05 Weakness changed · CISA ADP
References
More NetApp vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-36205 Redfish Authentication Bypass KEVCVSS 4.0CRITICAL 10.0
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-22060 · CVE Program
- CVE-2026-22060 · NVD
- FIRST EPSS
- GHSA-wrhp-xhf3-wvm3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences