NetApp Trident / Astra Vulnerabilities & Security Advisories
39 advisories tracked · NetApp Product Security Advisories (PSIRT) · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published NetApp advisory that VulniPulse classified as Trident / Astra, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 7 critical, 24 high, 8 medium, 1 low.
Source
NetApp Product Security Advisories (PSIRT)
Polled through NetApp Product Security's official advisory API. It supplies the canonical NTAP advisory ID, NetApp-calculated CVSS, affected and investigating products, remediation releases, workarounds and revision dates without relying on a third-party keyword search.
Latest NetApp Trident / Astra advisories
Medium [CVE-2026-22063] eMudhra CA Certificate Compromise in NetApp Products
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products. Successful attackers could perform a Man-in-the-Middle attack. ONTAP 9: The “AAA Certificate Services” root certificate was preinstalled in versions prior to 9.18.1. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. Affected products named by the advisory: Data Infrastructure Insights Acquisition Unit; Data Infrastructure Insights Telegraf Agent; E-Series SANtricity OS Controller Software; E-Series SANtricity Unified Manager and Web Services Proxy; and 5 more. Affected products named by the advisory: NetApp Console Agent Container (e-series); NetApp Console Agent Container (vector); NetApp HCI Baseboard Management Controller (BMC) - H610S; StorageGRID (formerly StorageGRID Webscale); and 1 more.
High [CVE-2026-22061] Debug Log Information Disclosure Vulnerability in Trident
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
High [CVE-2026-46600] Golang.Org/X/Net Vulnerability in NetApp Products
Golang. Org/X/Net versions prior to 0.56.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). StorageGRID (formerly StorageGRID Webscale):>br> Affected only in version 12.1. Affected products: NetApp Console Agent Container (tp-proxy), StorageGRID (formerly StorageGRID Webscale), Trident Protect Connector. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status.
High [CVE-2025-61728 +3] January 2026 Golang Vulnerabilities in NetApp Products
Golang versions prior to 1.24.12 and 1.25.0 prior to 1.25.6 are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). ONTAP tools for VMware vSphere 10: Affected only by CVE-2025-61730. Affected products: Astra Control Center. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-58183 +7] October 2025 Golang Vulnerabilities in NetApp Products
Golang versions prior to 1.24.8 and 1.25.0 prior to 1.25.2 are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of sensitive information or Denial of Service (DoS). Affected products: Astra Control Center, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-42504] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions through 1.25.9 and 1.26-rc1 through 1.26.2 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-27145] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions through 1.25.10 and 1.26.0 through 1.26.3 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data, Denial of Service (DoS). Affected products: Data Infrastructure Insights Telegraf Agent, NetApp Kubernetes Monitoring Operator, Trident, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2026-39828 +11] May 2026 Golang Crypto Vulnerabilities in NetApp Products
Golang Crypto versions prior to 0.52.0 are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent Container (tp-proxy), Trident Protect, Trident Protect Connector. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-34986] Go-Jose Vulnerability in NetApp Products
Multiple NetApp products incorporate Go-Jose. Go-Jose versions 3.0.0 prior to 3.0.5 and 4.0.0 prior to 4.1.4 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-33814] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.25.10 and 1.26.0 prior to 1.26.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-58187] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.9 and 1.25.0 prior to 1.25.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-39820] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.25.10 and 1.26.0 prior to 1.26.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-27137] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions 1.26.0-0 prior to 1.26.1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, Denial of Service (DoS). Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, Data Infrastructure Insights Telegraf Agent, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2026-27140 +8] April 2026 Golang Vulnerabilities in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.25.9 and 1.26.0-0 prior to 1.26.2 are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Trident: Affected by only CVE-2026-27143, CVE-2026-27144, CVE-2026-32281 and CVE-2026-32283. Not affected by CVE-2026-27140, CVE-2026-32282 and CVE-2026-32289. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time. Affected products named by the advisory: Astra Control Center; ONTAP tools for VMware vSphere 10; Trident Protect.
Critical [CVE-2025-68121] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.13, 1.25.0 prior to 1.25.7, and 1.26.0-rc1 prior to 1.26.0-rc3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-27142] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.25.8 and 1.26.0-0 prior to 1.26.1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-25679] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.25.8 and 1.26.0-0 prior to go1.26.1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, NetApp Kubernetes Monitoring Operator, ONTAP tools for VMware vSphere 10, Trident, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-0861] GNU C Library (glibc) Vulnerability in NetApp Products
Multiple NetApp products incorporate GNU C. GNU C Library (aka glibc) versions 2.30 through 2.42 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Active IQ Unified Manager for VMware vSphere, Brocade Fabric Operating System Firmware, NetApp HCI Baseboard Management Controller (BMC) - H610S, Trident. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-27141] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. golang.org/x/net/http2 versions 0.50.0 prior to 0.51.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center - NetApp Kubernetes Monitoring Operator. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-61726] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.12 and 1.25.0 prior to 1.25.6 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent, ONTAP tools for VMware vSphere 10, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-27171] Zlib Vulnerability in NetApp Products
Multiple NetApp products incorporate zlib. Zlib versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Trident: Affected when NFS is not installed on the Kubernetes node. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time. Affected products named by the advisory: Active IQ Unified Manager for Linux; Active IQ Unified Manager for Microsoft Windows; Management Services for Element Software and NetApp HCI; NetApp LOADER 8.x.
High [CVE-2022-40735] Diffie-Hellman Key Exchange Protocol Vulnerability in NetApp Products
The Diffie-Hellman Key Exchange Protocol is susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). E-Series SANtricity OS Controller Software: Affected only when SSH is enabled - it is disabled by default. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. Affected products named by the advisory: Astra Control Center; FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250; NetApp Manageability SDK; NetApp Shift Toolkit; and 2 more. Affected products named by the advisory: ONTAP Select Deploy administration utility; ONTAP tools for VMware vSphere 10.
High [CVE-2025-61729] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.11 and 1.25.0 prior to 1.25.5 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Data Infrastructure Insights Telegraf Agent, NetApp Console Agent, ONTAP tools for VMware vSphere 10, Trident. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-61727] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.11 and 1.25 prior to 1.25.5 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, or addition or modification of data. Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, Data Infrastructure Insights Telegraf Agent, NetApp Console Agent, ONTAP tools for VMware vSphere 10, Trident, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-58181] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang/x/crypto/ssh versions prior to 0.45.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Data Infrastructure Insights Telegraf Agent. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-47913] Golang.Org/X/Crypto Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Org/X/Crypto. Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-52881] Runc Vulnerability in NetApp Products
Multiple NetApp products incorporate runc. Runc versions prior to 1.2.8, prior to 1.3.3, and prior to 1.4.0-rc.3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-31133] Runc Vulnerability in NetApp Products
Multiple NetApp products incorporate runc. Runc versions prior to 1.2.8, prior to 1.3.3, and prior to 1.4.0-rc.3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-4674] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.23.11 and 1.24.0 prior to 1.24.5 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, NetApp Kubernetes Monitoring Operator. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-47907] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.23.12, prior to 1.24.6, and prior to 1.25-rc3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-4673] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.23.10 and 1.24.0 prior to 1.24.4 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information. Successful exploitation of this vulnerability could lead to disclosure of sensitive information. Affected products: Astra Control Center, NetApp Console Agent, Trident, Trident Autosupport, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2025-7783] Form-Data Vulnerability in NetApp Products
Multiple NetApp products incorporate form-data. Form-data versions prior to 4.0.4, prior to 3.0.4 and prior to 2.5.4 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. Affected products: Active IQ Unified Manager for Linux, Active IQ Unified Manager for Microsoft Windows, Active IQ Unified Manager for VMware vSphere, Astra Control Center, NetApp Shift Toolkit. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-22871] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.23.8 and 1.24.0-0 prior to 1.24.2 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. Affected products: Astra Control Center, Astra Control Center - NetApp Kubernetes Monitoring Operator, Astra Control Provisioner, Data Infrastructure Insights Telegraf Agent, NetApp Console Agent, NetApp Kubernetes Monitoring Operator, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-22870] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Net/httpproxy and net/proxy prior to 0.36.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. Affected products: Astra Control Center, Trident, Trident Autosupport, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-22869] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Crypto/ssh versions prior to 0.35.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2024-45341] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions 1.10-beta1 through 1.22.10, 1.23.0-0 through 1.23.4, 1.24.0-0 through 1.24.0-rc.1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data. Affected products: Astra Control Center - NetApp Kubernetes Monitoring Operator, Data Infrastructure Insights Telegraf Agent, NetApp Kubernetes Monitoring Operator. NetApp states there is no workaround available at this time.
Low [CVE-2024-45310] runc Vulnerability in NetApp Products
Multiple NetApp products incorporate the runc library. runc versions through 1.1.13 and through 1.2.0-rc.2 are susceptible to a vulnerability which when exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. Affected products: Astra Control Center, NetApp HCI Compute Node (Bootstrap OS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2024-45337] golang.org/x/crypto Vulnerability in NetApp Products
Multiple NetApp products incorporate golang.org/x/crypto. golang.org/x/crypto versions prior to 0.31.0 are susceptible to a vulnerability which when successfully exploited could lead to isclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, Data Infrastructure Insights Telegraf Agent, NetApp HCI Compute Node (Bootstrap OS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Critical [CVE-2024-24790] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to go1.21.11 and go1.22.0-0 prior to go1.22.4 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center. NetApp states there is no workaround available at this time.
Get an email when NetApp Trident / Astra publishes the next one.
See NetApp Trident / Astra's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor NetApp Trident / Astra CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
