{"resourceId":"netapp-advisory-ntap-20261103-0002-storagegrid-internal-api-auth-bypass-20261103","versions":[{"version":"external-1ae3048dcdf73dfd88a8745f10021692d203fe3667d51bc81b59d6b20f50a36d","resource":{"id":"netapp-advisory-ntap-20261103-0002-storagegrid-internal-api-auth-bypass-20261103","title":"NetApp advisory NTAP-20261103-0002: StorageGRID unauthenticated access to internal grid APIs (CVE-2026-22060, CVSS 4.0 6.9)","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"3 November 2026","publicationDate":"2026-11-03","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261103-0002, 3 November 2026","sourceUrl":"https://security.netapp.com/advisory/NTAP-20261103-0002","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NetApp published final advisory NTAP-20261103-0002 on 3 November for CVE-2026-22060. NetApp says all StorageGRID versions in default and common configurations let an unauthenticated attacker reach a limited set of APIs meant for use inside the grid, which could expose sensitive information or add or modify data. NetApp rates it medium (CVSS 4.0 score 6.9) and says it is not aware of public discussion.","sledRelevance":"Applies to every SLED StorageGRID deployment regardless of version, because NetApp says default configurations are affected. Agencies and campuses storing research, backup or AI pipeline data in StorageGRID should check exposure even though severity is medium.","evidence":"Opened the rendered advisory page and read all sections. Vendor self-disclosure; no independent analysis found.","architectureImplications":"Internal grid APIs should not be reachable from client networks.","governanceImplications":"Track remediation alongside NTAP-20261103-0001.","securityPrivacyImplications":"Limited unauthorized API access could disclose or modify data.","caveats":"Vendor-reported; medium severity; no exploitation reported; fix details not shown in rendered summary.","streamIds":["netapp"],"roles":{"sales":"Use this as a service conversation, not a sales pitch. On 3 November NetApp also disclosed CVE-2026-22060, which affects all StorageGRID versions in default configurations. Agencies, universities and districts that keep backups, research data or AI training datasets on StorageGRID object storage will want to know whether they are exposed. Offer a short exposure check and patch-planning session. Do not claim any customer was attacked; NetApp says it is not aware of public discussion.","engineering":"Confirm StorageGRID versions and which hosts can reach the Grid Network. The main control is network isolation: the Grid Network should be reachable only by grid nodes, never by user, campus or internet segments. Check the advisory for fixed versions before scheduling upgrades, review audit logs for unexpected internal API requests, and confirm S3 data used by AI pipelines has not been modified.","delivery":"Treat this as patch and hardening work owned by the storage or infrastructure team, with security operations reviewing logs. Governance checkpoints are a change-approval window and a post-upgrade check. Acceptance criteria below are proposals. The main risk is upgrade disruption to backup or research workloads during busy periods."},"roleDetails":{"sales":{"customerProblem":"SLED IT teams running StorageGRID need to know quickly whether new authentication-bypass flaws expose sensitive data.","stakeholders":["CIO or CISO","Storage and infrastructure manager","Research computing director","Security operations"],"discoveryQuestions":["Which StorageGRID versions do you run?","Which networks can reach the Grid Network?","What sensitive or AI training data lives in StorageGRID buckets?"],"valueHypothesis":"A fast exposure check reduces risk and builds trust with existing NetApp customers.","potentialEngagement":"A bounded exposure review and upgrade plan for StorageGRID.","unsupportedClaims":["Active exploitation","Any customer compromise","Specific fixed versions not read from the advisory"]},"engineering":{"fit":"Any SLED organization running StorageGRID 11.3 or later, or any version for CVE-2026-22060.","architectureIntegration":"Grid Network segmentation from client and admin networks; internal grid APIs should not be reachable from outside.","prerequisites":["StorageGRID version inventory","Network map of Grid Network reachability","Access to audit logs"],"constraints":["Fixed-version details not captured in rendered summary","Upgrades require maintenance windows"],"security":"Restrict Grid Network access; review logs for unauthorized requests; verify integrity of critical buckets.","proofOfValue":["All nodes on fixed release","Grid Network unreachable from non-grid segments","No anomalous internal API calls found"]},"delivery":{"work":"Inventory, isolate the Grid Network, upgrade and verify.","dependencies":["NetApp fixed releases","Change window","Storage staff time"],"ownership":"Storage/infrastructure manager with security operations.","skillsAdoption":"Staff need StorageGRID upgrade and network-segmentation familiarity.","governanceCheckpoints":["Change approval","Post-upgrade security verification"],"acceptanceCriteria":["All StorageGRID nodes upgraded (proposal)","Segmentation test passed (proposal)"],"risks":["Upgrade disruption","Incomplete inventory","Unpatched remote sites"]}},"retrievedAt":"2026-11-03T22:12:00-06:00","enrichedAt":"2026-11-03T22:25:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Storage teams may need vendor or partner help to schedule upgrades.","procurementImplications":"No procurement change; existing support contracts cover fixes.","operatingModelImplications":"Storage and security teams should coordinate patch windows and log review.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/NTAP-20261103-0002","referenceExcerpt":"in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}