From the NetApp edition of November 5, 2026
NetApp advisory NTAP-20261030-0015 v2.0: critical PyJWT flaw (CVE-2026-102268); ransomware-protection agent cleared on 5 Nov
NetApp Product Security · Storage vendor security advisory · Global
- Publisher
- NetApp Product Security
- Original publication
- Advisory v2.0, last updated 5 November 2026
- Source retrieved
- 2026-11-06
What happened
On 5 November 2026 NetApp revised NTAP-20261030-0015 to v2.0 for CVE-2026-102268, a critical (CVSS 3.1 score 9.1) PyJWT issue through 2.13.0 that can lead to disclosure of sensitive information or addition or modification of data. The revision moved NetApp Console Agent Container (ransomware-protection) to Products Not Affected. The official advisory API still lists no products under Affected; Investigating includes Console Agent Container (compliance), Console Agent OVA, NetApp Data Classification, SolidFire & HCI management and storage nodes, and NetApp XCP NFS and SMB. AI Data Engine (AIDE), ONTAP 9, StorageGRID, SnapCenter and Active IQ Unified Manager appear on the Not Affected list. Status remains Interim; public discussion noted; workarounds: none at this time; no fixes listed.
Why it matters
Relevant to SLED estates using NetApp Console agents, Data Classification or XCP migration tools—the components still under Investigating—while AIDE-based AI metadata pipelines and core ONTAP 9 are listed Not Affected. Agencies and campuses modernizing AI data governance with Console agents should verify which agent containers they deploy.
Evidence and measured results
Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261030-0015; read summary, impact, scoring, revision history, investigating and unaffected lists. Vendor self-disclosure; GitHub PyJWT advisory referenced.
Limitations and uncertainty
Interim; Affected list empty; Investigating products may still be cleared; no workaround or fix published; product lists from NetApp adv_api (HTML page omitted tables); AIDE Not Affected does not prove every Console Agent container is safe.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- SLED teams need clarity on whether Console agents, Data Classification or XCP sit in the PyJWT Investigating set.
- Stakeholders
- CISO
- Storage manager
- Data governance lead
- Discovery questions
- Which NetApp Console Agent containers or OVA do you run?
- Do you use NetApp Data Classification or XCP NFS/SMB?
- Value hypothesis
- Accurate container-level inventory keeps AI data-platform work from stalling on unclear advisory scope.
- Potential engagement
- A bounded Console Agent / XCP advisory-mapping workshop.
- Unsupported claims
- AIDE is affected
- Any Investigating product is confirmed Affected
- Active SLED exploitation
Pre-sales engineering
Role takeaway
- Fit
- Estates with Investigating Console Agent, Data Classification or XCP components; low fit for AIDE-only stacks listed Not Affected.
- Architecture and integration
- Isolate Investigating agent and XCP endpoints from untrusted networks pending fixes.
- Prerequisites
- Console Agent container inventory
- XCP and Data Classification deployment map
- Constraints
- Interim advisory
- Empty Affected list
- No workaround or fix
- Security
- Limit exposure of Investigating PyJWT-bearing components; patch when NetApp publishes fixes.
- Proof of value
- Investigating components mapped
- Agent/XCP endpoints unreachable from non-admin segments
Delivery
Role takeaway
- Work
- Inventory Investigating components, restrict access, track the advisory, patch when listed.
- Dependencies
- NetApp product disposition and fixes
- Change window for agents/XCP
- Ownership
- Security operations with storage and data-governance owners.
- Skills and adoption
- No new skills; container and tool inventory discipline.
- Governance checkpoints
- Change approval for agent/XCP updates
- Close only when Investigating items are cleared or patched
- Acceptance criteria
- Investigating Console/XCP/Data Classification components inventoried (proposal)
- Listed products patched or confirmed Not Affected (proposal)
- Risks
- Assuming AIDE Not Affected covers all Console Agents
- Overlooked XCP migration hosts
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Treat Investigating Console Agent, Data Classification and XCP components as pending exposure until cleared; keep them off untrusted networks and re-check scope before expanding AI data-classification agents.
Governance
Who approves, reviews and stays accountable for outcomes?
Track Interim status until Investigating products receive fixes or Not Affected disposition; record which Console Agent containers are in production.
Security and privacy
What data, permissions and controls need testing?
Successful exploitation could disclose sensitive information or add or modify data where vulnerable PyJWT is reachable.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
SLED teams may need partner help to map Console Agent container variants and XCP usage to the Investigating list.
Procurement
What should contracts, pricing and exit terms secure?
No new purchase; prioritize patch readiness under existing support for Investigating Console/XCP components.
Operating model
Which teams own the service once it runs?
Security, storage and data-governance owners should jointly track Console Agent and classification tooling.
Publication history
- 2026-11-05NetApp · Issue 072 resources
Stable resource ID: netapp-advisory-ntap-20261030-0015-pyjwt-critical-v2-20261105