NetApp StorageGRID login bypass leaves branches 11.3 to 11.8 unfixed

NetApp StorageGRID login bypass leaves branches 11.3 to 11.8 unfixed

4 November 2026: NetApp StorageGRID has a critical authentication bypass, CVE-2026-22058, and only three release lines get a fix, according to Spain's INCIBE-CERT. Anyone still on branches 11.3 to 11.8 has no patched version in their own line and must move up to one, although no exploitation had been reported at publication.

Not yet independently verified. NetApp's own advisory NTAP-20261103-0001 would not load as text for us, so every detail here comes from INCIBE-CERT's notice on it. We have no CVSS score or NetApp publication date. We will update this when it can be confirmed, and remove this note.

Fixed versions and the branches left behind

The notice lists these as affected and fixed:

• 11.3 to 11.8: no fixed release in these branches, migrate to a fixed version
• 11.9 before 11.9.0.15: upgrade to 11.9.0.15
• 12.0 before 12.0.0.9: upgrade to 12.0.0.9
• 12.1 before 12.1.0.1: upgrade to 12.1.0.1

The older branches are the awkward part. A site on 11.8 now has a security reason for a move that it may have been putting off. Planning should start from which branch each grid runs and how long a jump to 11.9 or later will take.

How an attacker gets in

INCIBE describes an alternative path that sidesteps authentication and allows unauthorised requests, putting confidentiality and integrity at risk. It rates the flaw critical but adds two limits: the attacker needs specific knowledge of StorageGRID, and must be able to talk to certain ports on the Grid Network.

That second condition is the useful one for now. The Grid Network carries traffic between a grid's nodes. A site that has kept it separated has less immediate exposure than one where it has been routed more widely, so checking who can reach those ports is a sensible first task while the upgrade is scheduled. The notice does not list which ports.

What storage teams should look at first

Object stores often sit behind backup and archive software, and that means the data within reach of an unauthorised request can be a company's recovery copy. Teams should pull a list of grids and versions, then check the Grid Network's firewall rules, and confirm whether any backup product writes to a grid that falls in the unfixed range.

NetApp's advisory, NTAP-20261103-0001, is the document to read for port and version detail. Our cloud storage software category lists eight products for teams weighing up a migration rather than an in-place upgrade.

Related on TrustList:

• Dropbox plans to buy object storage firm Tigris Data

Sources

• INCIBE-CERT: Authentication bypass in NetApp StorageGRID, INCIBE-2026-832, 4 November 2026, 4 November 2026
• NetApp advisory NTAP-20261103-0001 (page did not load as text, read 7 November 2026), 7 November 2026