← Back

CVE-2025-26515

nvd nist
Published: Sep 19, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: security-alert@netapp.com (Secondary)

Description

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an unauthenticated attacker to change the password of any Grid Manager or Tenant Manager non-federated user.

Affected (2)

Products: Netapp: Storagegrid
Netapp
1 product
Storagegrid
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Netapp
Storagegrid
Before 11.8.0.15
Storagegrid
From 11.9.0 to 11.9.0.8

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security-alert@netapp.com
Vendor Advisory

Timeline

No history available yet.