CVE-2026-22051

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.netapp.com/advisory/ntap-20260420-0001	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netapp:storagegrid::::::::
	cpe:2.3:a:netapp:storagegrid::::::::

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) StorageGRID (anteriormente StorageGRID Webscale) versiones anteriores a la 11.9.0.13 y 12.0.0.6 son susceptibles a una vulnerabilidad de revelación de información. Un exploit exitoso podría permitir a un atacante autenticado con privilegios bajos ejecutar consultas de métricas arbitrarias, revelando resultados de métricas a los que no tienen acceso.

Information

Published : 2026-04-20 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-22051

Mitre link : CVE-2026-22051

CVE.ORG link : CVE-2026-22051

JSON object : View

Products Affected

netapp

storagegrid

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-22051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22051", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T13:40:42.595085Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-alert@netapp.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-alert@netapp.com", "affectedData": [{"vendor": "NETAPP", "product": "StorageGRID (formerly StorageGRID Webscale)", "versions": [{"status": "affected", "version": "0", "lessThan": "11.9.0.13", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "12.0.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-20T22:16:23.367", "references": [{"url": "https://security.netapp.com/advisory/ntap-20260420-0001", "tags": ["Vendor Advisory"], "source": "security-alert@netapp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to."}, {"lang": "es", "value": "StorageGRID (anteriormente StorageGRID Webscale) versiones anteriores a la 11.9.0.13 y 12.0.0.6 son susceptibles a una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n. Un exploit exitoso podr\u00eda permitir a un atacante autenticado con privilegios bajos ejecutar consultas de m\u00e9tricas arbitrarias, revelando resultados de m\u00e9tricas a los que no tienen acceso."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B754F822-D066-4C69-BC29-2020129FF8AA", "versionEndExcluding": "11.9.0.13"}, {"criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F124B755-8A4B-4544-BFAE-F0C2639CBB93", "versionEndExcluding": "12.0.0.6", "versionStartIncluding": "12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@netapp.com"}