CVE-2026-22060: Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Published Nov 3, 2026

Updated

All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.

Event History

Nov 3, 2026

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

DescriptionWeakness

Data Sourced

via NVD·10:19 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

All versions of StorageGRID (formerly StorageGRID Webscale) are affected when using default and common configurations.

What does an attacker need to exploit this issue?

The attacker does not need to authenticate and can exploit the issue over the network. The exposed functionality is limited to a set of APIs intended for internal grid use.

What impact is described from successful exploitation?

An unauthenticated attacker can access limited internal-grid APIs. The provided severity vector indicates low impact to confidentiality and integrity, including in a subsequent security context, with no availability impact indicated.

CVE-2026-22060: Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What impact is described from successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What impact is described from successful exploitation?