---
id: "CVE-2026-76052"
page: "https://infrastack.ai/live/CVE-2026-76052"
kind: "vulnerability"
aliases: ["CVE-2026-76052"]
title: "IBM Storage Scale: undocumented flag opens unauthenticated REST API path"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-storage-scale", "ibm-storage-scale-system", "infrastructure", "rest-api", "self-hosted"]
not_affected_if: ["outside-affected-ranges"]
published_at: "2026-11-08T18:17:04+00:00"
first_seen_at: "2026-11-08T18:22:22+00:00"
updated_at: "2026-11-08T18:22:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76052", "first_seen_at": "2026-11-08T18:22:22+00:00"}]
exploit_sources: []
---

# IBM Storage Scale: undocumented flag opens unauthenticated REST API path

Link for people: https://infrastack.ai/live/CVE-2026-76052 (this .md is for agents)

IBM Storage Scale and Storage Scale System releases contain an undocumented flag that exposes an unauthenticated path in the REST API. An attacker who reaches the API can use that path without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM Storage Scale or Storage Scale System version against the affected ranges in the description (5.2.3.0 through 5.2.3.8, 6.0.0.0 through 6.0.1.0, 6.2.3.0 through 6.2.3.6, 7.0.0.0 through 7.0.1.0).

## Timeline

- 2026-11-08T18:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76052

## From the sources

IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_