{"id":"CVE-2026-22060","title":"CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)","summary":"All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","vendor":"NETAPP","product":"StorageGRID (formerly StorageGRID Webscale)","affected":["storagegrid_formerly_storagegrid_webscale < 11.9.0.15, 12.0.0.9, 12.1.0.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T15:15:33.631806Z"},"published":"2026-11-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:58:03.045Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22060","references":[{"url":"https://security.netapp.com/advisory/NTAP-20261103-0002"}],"tags":["cve.org"],"epss":0.00333,"epssPercentile":0.26728,"ingestedAt":"2026-11-05T22:38:31.316Z","slug":"CVE-2026-22060","body":"## Overview\n\nAll versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.\n\n## Affected\n\n- `storagegrid_formerly_storagegrid_webscale < 11.9.0.15, 12.0.0.9, 12.1.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}