Server-Side Request Forgery Vulnerability in StorageGRID by NetApp
CVE-2026-22048

7.1HIGH

Key Information:

Vendor

Netapp

Status
Storagegrid (formerly Storagegrid Webscale)
Vendor
CVE Published:
17 February 2026

What is CVE-2026-22048?

The StorageGRID product from NetApp is impacted by a Server-Side Request Forgery (SSRF) vulnerability when Single Sign-On is enabled with Microsoft Entra ID as the Identity Provider. This flaw allows an attacker with low privileges, who successfully exploits it, to potentially delete critical configuration data or restrict access to specific resources. Ensuring your software is updated to versions 11.9.0.12 or 12.0.0.4 or later is crucial to mitigate this risk. For detailed remediation advice, visit the NetApp security advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

StorageGRID (formerly StorageGRID Webscale) 0 < 11.9.0.12

StorageGRID (formerly StorageGRID Webscale) 12.0.0.0 < 12.0.0.4

References

https://security.netapp.com/advisory/NTAP-20260217-0001

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.