NetApp Trident: Sensitive information exposure in debug logs
Summary
NetApp Trident, a storage orchestrator for Kubernetes that provisions storage from NetApp backends, writes sensitive data into its debug logs (CWE-215). An authenticated attacker who can read these debug logs can obtain LUKS passphrases or SMB Active Directory credentials. The attack is local and needs low privileges, so the risk depends on who can access the logs.
Affected
- Trident v25.02.1 through v26.06.1 (per CNA record; default status: unaffected)
- Some third-party sources differ in version range and CVSS score; the CNA record is treated as authoritative.
Fixed in
- Trident v26.06.2 (GitHub release notes list CVE-2026-22061; to be confirmed on NetApp advisory NTAP-20261009-0026)
- Fixes in earlier maintenance branches: Unknown.
Workaround
- Disable debug-level logging in unfixed versions (reported by a secondary source, not confirmed by NetApp).
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No public proof of concept found and no evidence of known exploitation.
- NetApp exploitation status: Unknown.
Our recommendation
- Check whether Trident is deployed and which version is running.
- Upgrade to v26.06.2 or a confirmed fixed version.
- Check whether debug logging is enabled and disable it where possible.
- Restrict read access to Trident pod logs and log aggregation systems (Kubernetes RBAC).
- If logs were exposed, rotate SMB/AD service account credentials and LUKS passphrases.
- Monitor the NetApp advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NetApp Security Advisory NTAP-20261009-0026 security.netapp.com
- Trident v26.06.2 release notes github.com
- VulDB CVE-2026-22061 vuldb.com
- HOL Guard CVE-2026-22061 hol.org
- OffSeq Radar CVE-2026-22061 radar.offseq.com
- Rapid7 via Vulners CVE-2026-22061 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:43.
Original description (NVD)
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.