---
id: CVE-2026-22060
title: >-
  CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly
  StorageGRID Webscale)
summary: >-
  All versions of StorageGRID (formerly StorageGRID Webscale) in default &
  common configurations allow an unauthenticated attacker to access a limited
  set of APIs that are intended for use within the grid.
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
vendor: NETAPP
product: StorageGRID (formerly StorageGRID Webscale)
affected:
  - 'storagegrid_formerly_storagegrid_webscale < 11.9.0.15, 12.0.0.9, 12.1.0.1'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T15:15:33.631806Z'
published: '2026-11-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:58:03.045Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22060'
references:
  - url: 'https://security.netapp.com/advisory/NTAP-20261103-0002'
tags:
  - cve.org
epss: 0.00333
epssPercentile: 0.26728
ingestedAt: '2026-11-05T22:38:31.316Z'
---

## Overview

All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.

## Affected

- `storagegrid_formerly_storagegrid_webscale < 11.9.0.15, 12.0.0.9, 12.1.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.