NetApp StorageGRID: Authentication bypass (CVE-2026-22058)
NetApp StorageGRID versions 11.3 and higher are vulnerable to an authentication bypass (CVE-2026-22058) that allows unauthorized requests via the Grid Network. Public proof-of-concept exploit code has been published.
CVE search metadata
CVE search record: CVE-2026-22058. KEV: no. Product: StorageGRID (>= 11.3), StorageGRID. Brief: NetApp StorageGRID: Authentication bypass (CVE-2026-22058). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netapp-storagegrid-auth-bypass/
Triage facts
Revision 2- Applicability
- StorageGRID (>= 11.3), StorageGRID
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 2Nov 4, 16:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
added coverage for StorageGRID
Changed: action_plan, affected_products, lastmod, qa_status, references, tags, updates
Sources: 1
NetApp has disclosed a high severity authentication bypass vulnerability, tracked as CVE-2026-22058, affecting StorageGRID versions 11.3 and higher. An attacker with product-specific knowledge and the ability to communicate with the Grid Network can perform unauthorized requests. Public proof-of-concept exploit code is available on Sploitus.
Immediate actions
Inventory all NetApp StorageGRID instances.
Enrichment needed
- Affected version ranges (CTI) Necessary to determine patch requirements
Mitigations
Monitor NetApp security bulletin and apply patches as soon as they become available.
NetApp StorageGRID