{"id":"CVE-2026-22060","kind":"vulnerability","aliases":["CVE-2026-22060"],"related":[],"title":"StorageGRID: unauthenticated attacker reaches internal-only grid APIs by default","description":"All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.","summary":"StorageGRID, NetApp's object storage product, exposes a limited set of APIs meant only for internal grid communication in default and common configurations. An unauthenticated attacker who can reach them can call those internal APIs.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","netapp","object-storage","storagegrid"],"not_affected_if":["grid-network-isolated"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T22:19:47+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","triaged_at":"2026-11-03T23:16:14+00:00","updated_at":"2026-11-03T23:16:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T23:16:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"StorageGRID: unauthenticated attacker reaches internal-only grid APIs by default","impact":"medium","summary":"StorageGRID, NetApp's object storage product, exposes a limited set of APIs meant only for internal grid communication in default and common configurations. An unauthenticated attacker who can reach them can call those internal APIs.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["storagegrid","object-storage","netapp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated callers invoke internal grid APIs, scope of impact unspecified","analyst_note":"Find the NetApp advisory for CVE-2026-22060 to confirm affected versions, the exposed API endpoints, and whether a patched release exists.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["grid-network-isolated"],"who_is_affected":"Organizations running StorageGRID in default or common configurations where grid API ports are reachable from a network an attacker can reach. The sources do not say which API endpoints are exposed or which networks should be restricted, so exposure depends on how the grid's network is segmented. Deployments where grid interfaces are isolated from untrusted networks are likely less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4089,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-22060':14A,17A 'access':75C 'allow':70C 'api':9A,35B,58B,80C 'attack':3A,49B,73C 'call':55B 'common':45B,68C 'communic':41B 'configur':46B,69C 'cve':12A,15A 'default':11A,43B,67C 'expos':30B 'former':63C 'grid':8A,40B,88C 'infrastructur':18B 'intend':83C 'intern':6A,39B,57B 'internal-on':5A 'limit':32B,77C 'meant':36B 'netapp':19B,25B 'object':21B,27B 'object-storag':20B 'product':29B 'reach':4A,52B 'set':33B,78C 'storag':22B,28B 'storagegrid':1A,23B,24B,62C,64C 'unauthent':2A,48B,72C 'use':85C 'version':60C 'webscal':65C 'within':86C","nicknames":[],"mitigations":[],"who_affected":"Organizations running StorageGRID in default or common configurations where grid API ports are reachable from a network an attacker can reach. The sources do not say which API endpoints are exposed or which networks should be restricted, so exposure depends on how the grid's network is segmented. Deployments where grid interfaces are isolated from untrusted networks are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","netapp","objectstorage","storagegrid"],"campaign_type":null,"first_public_at":"2026-11-03T22:19:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-alert@netapp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-22060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22060","severity":null,"published_at":"2026-11-03T22:19:47+00:00","modified_at":"2026-11-03T22:19:47+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}