CVE-2026-76052 · Infrastructure
NO FIX YET
IBM Storage Scale and Storage Scale System releases contain an undocumented flag that exposes an unauthenticated path in the REST API. An attacker who reaches the API can use that path without logging in.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running the affected IBM Storage Scale or Storage Scale System releases with the REST API reachable on their network. The sources do not say whether the flag is enabled by default, so exposure is unknown; systems on other versions are not in the stated ranges.
Not affected if outside-affected-ranges
Who cares ibm-storage-scale, ibm-storage-scale-system, rest-api, self-hosted
No fix yet, per the sources.
IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.