{"resourceId":"netapp-advisory-ntap-20261103-0001-storagegrid-auth-bypass-critical-20261103","versions":[{"version":"external-1ae3048dcdf73dfd88a8745f10021692d203fe3667d51bc81b59d6b20f50a36d","resource":{"id":"netapp-advisory-ntap-20261103-0001-storagegrid-auth-bypass-critical-20261103","title":"NetApp advisory NTAP-20261103-0001: critical StorageGRID authentication bypass (CVE-2026-22058, CVSS 4.0 9.1)","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"3 November 2026","publicationDate":"2026-11-03","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261103-0001, 3 November 2026","sourceUrl":"https://security.netapp.com/advisory/NTAP-20261103-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NetApp published final advisory NTAP-20261103-0001 on 3 November for CVE-2026-22058 in StorageGRID, its object storage software. NetApp says versions 11.3 and later let an attacker with product-specific knowledge who can reach the Grid Network on certain ports make unauthorized requests, which could expose sensitive information or add or modify data. NetApp rates it critical (CVSS 4.0 score 9.1, high attack complexity) and says it is not aware of public discussion of the flaw.","sledRelevance":"Relevant to state agencies, universities, research centers and K-12 districts using StorageGRID for backups, archives, research data or AI training data lakes. The attack needs access to the Grid Network, so exposure depends mostly on how well that network is isolated.","evidence":"Opened the rendered advisory page and read summary, impact, scoring and exploitation sections. This is a vendor self-disclosure; no independent analysis was found.","architectureImplications":"Grid Network isolation is the key architectural control.","governanceImplications":"Patch and segmentation should go through normal change governance.","securityPrivacyImplications":"Possible disclosure or modification of stored data, including sensitive records and AI datasets.","caveats":"Vendor-reported; rendered page did not show affected-version fix details beyond the summary; no exploitation reported.","streamIds":["netapp"],"roles":{"sales":"Use this as a service conversation, not a sales pitch. On 3 November NetApp disclosed a critical StorageGRID authentication bypass, CVE-2026-22058, that requires access to the Grid Network. Agencies, universities and districts that keep backups, research data or AI training datasets on StorageGRID object storage will want to know whether they are exposed. Offer a short exposure check and patch-planning session. Do not claim any customer was attacked; NetApp says it is not aware of public discussion.","engineering":"Confirm StorageGRID versions and which hosts can reach the Grid Network. The main control is network isolation: the Grid Network should be reachable only by grid nodes, never by user, campus or internet segments. Check the advisory for fixed versions before scheduling upgrades, review audit logs for unexpected internal API requests, and confirm S3 data used by AI pipelines has not been modified.","delivery":"Treat this as patch and hardening work owned by the storage or infrastructure team, with security operations reviewing logs. Governance checkpoints are a change-approval window and a post-upgrade check. Acceptance criteria below are proposals. The main risk is upgrade disruption to backup or research workloads during busy periods."},"roleDetails":{"sales":{"customerProblem":"SLED IT teams running StorageGRID need to know quickly whether new authentication-bypass flaws expose sensitive data.","stakeholders":["CIO or CISO","Storage and infrastructure manager","Research computing director","Security operations"],"discoveryQuestions":["Which StorageGRID versions do you run?","Which networks can reach the Grid Network?","What sensitive or AI training data lives in StorageGRID buckets?"],"valueHypothesis":"A fast exposure check reduces risk and builds trust with existing NetApp customers.","potentialEngagement":"A bounded exposure review and upgrade plan for StorageGRID.","unsupportedClaims":["Active exploitation","Any customer compromise","Specific fixed versions not read from the advisory"]},"engineering":{"fit":"Any SLED organization running StorageGRID 11.3 or later, or any version for CVE-2026-22060.","architectureIntegration":"Grid Network segmentation from client and admin networks; internal grid APIs should not be reachable from outside.","prerequisites":["StorageGRID version inventory","Network map of Grid Network reachability","Access to audit logs"],"constraints":["Fixed-version details not captured in rendered summary","Upgrades require maintenance windows"],"security":"Restrict Grid Network access; review logs for unauthorized requests; verify integrity of critical buckets.","proofOfValue":["All nodes on fixed release","Grid Network unreachable from non-grid segments","No anomalous internal API calls found"]},"delivery":{"work":"Inventory, isolate the Grid Network, upgrade and verify.","dependencies":["NetApp fixed releases","Change window","Storage staff time"],"ownership":"Storage/infrastructure manager with security operations.","skillsAdoption":"Staff need StorageGRID upgrade and network-segmentation familiarity.","governanceCheckpoints":["Change approval","Post-upgrade security verification"],"acceptanceCriteria":["All StorageGRID nodes upgraded (proposal)","Segmentation test passed (proposal)"],"risks":["Upgrade disruption","Incomplete inventory","Unpatched remote sites"]}},"retrievedAt":"2026-11-03T22:12:00-06:00","enrichedAt":"2026-11-03T22:25:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Storage teams may need vendor or partner help to schedule upgrades.","procurementImplications":"No procurement change; existing support contracts cover fixes.","operatingModelImplications":"Storage and security teams should coordinate patch windows and log review.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/NTAP-20261103-0001","referenceExcerpt":"allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}