Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

StorageGRID: Low-Privilege Users Can Access Unauthorized Data

CVE-2026-22051 · published 6 months ago
Summary

StorageGRID versions prior to 11.9.0.13 and 12.0.0.6 have a security issue that allows people with limited access to view sensitive information they shouldn't be able to see. This could happen if an attacker with low privileges uses a specific feature to access data they shouldn't have access to. To stay safe, update to the latest version or patch if available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netapp storagegrid < 11.9.0.13
>= 12.0, < 12.0.0.6
cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*
Original advisory text
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attac...
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published20 Apr 2026
Updated3 Nov 2026
First seen20 Apr 2026
Sources
CVE-2026-22051 · NVD
Track software like this
Free during beta