6.9 Medium

CVE-2026-22060 CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Description

All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: Low
Integrity: Low
Availability: None
Confidentiality of other systems: Low
Integrity of other systems: Low
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
StorageGRID (formerly StorageGRID Webscale)	Versions not published

References

security.netapp.com security.netapp.com

Timeline

Published November 3, 2026
Last modified November 5, 2026

The 8 CVEs of StorageGRID (formerly StorageGRID Webscale) →

CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 9.1 Critical CVE-2026-22063 CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products 6.0 Medium CVE-2026-22051 StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information… 2.3 Low CVE-2026-22048 StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and… 7.1 High

Track this CVE