Home

Description

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.

PUBLISHED Reserved 2026-01-05 | Published 2026-02-17 | Updated 2026-02-17 | Assigner netapp




HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Problem types

918

Product status

Default status
unaffected

Any version before 11.9.0.12
affected

12.0.0.0 (custom) before 12.0.0.4
affected

References

security.netapp.com/advisory/NTAP-20260217-0001

cve.org (CVE-2026-22048)

nvd.nist.gov (CVE-2026-22048)

Download JSON