Live › vulnerability › CVE-2026-22060
StorageGRID, NetApp's object storage product, exposes a limited set of APIs meant only for internal grid communication in default and common configurations. An unauthenticated attacker who can reach them can call those internal APIs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Organizations running StorageGRID in default or common configurations where grid API ports are reachable from a network an attacker can reach. The sources do not say which API endpoints are exposed or which networks should be restricted, so exposure depends on how the grid's network is segmented. Deployments where grid interfaces are isolated from untrusted networks are likely less exposed, but the sources do not confirm this.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.
This page as .md · .json · in your agent: get_signal("CVE-2026-22060")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.