NetApp ONTAP, StorageGRID and SANtricity: trust in eight compromised eMudhra intermediate CAs

Impact

The private keys of eight eMudhra intermediate CA certificates were compromised, and NetApp storage products that ship or accept those intermediates in their trust stores will keep accepting certificates chaining to them until updated. On a GPU fleet this matters because ONTAP and StorageGRID commonly front the training dataset and checkpoint tiers: an attacker able to issue a certificate under a compromised intermediate and position themselves on the path can impersonate a TLS endpoint the storage system or its management clients trust, enabling interception or redirection of storage and management traffic. NetApp states this is not a software flaw in its products; the CVE exists to track the trust-store changes. eMudhra revoked the eight intermediates on 2026-10-18, so validation depends on each component actually honoring revocation.

Who can reach it

Network attacker who can obtain a certificate chaining to one of the compromised intermediates and intercept or redirect TLS connections involving the storage system or its management interfaces. No authentication to the NetApp system is required, but the CNA's own metric notes high attack complexity and a passive user/path requirement.

What to do

Follow NetApp advisory NTAP-20261027-0001 for the affected ONTAP 9, StorageGRID and E-Series SANtricity OS releases and apply the trust-store updates it lists for your version; where no update is published yet, remove or distrust the eight revoked eMudhra intermediates in the product trust store and reissue any certificates in use that chain to them. The advisory describes no code fix, so there is no patch level to chase - do not assume a controller reboot or firmware activity is required beyond what the advisory states for your platform.

References

Related entries

• OpenStack Swift: S3API does not strip X-Copy-From, allowing cross-tenant object readsCVE-2026-71192 · OpenStack Swift S3API middleware (X-Copy-From header handling with s3_acl=true)Medium
• Grafana: OAuth and OIDC access, refresh and ID tokens written unredacted to server logsCVE-2026-79656 · Grafana (OAuth/OIDC login - unredacted tokens written to server logs)Medium
• AMD NBIO register lock bits - MMIO routing configuration: The sibling of the SMN issue: unprotected NBIO lock bits letCVE-2025-61971 · AMD NBIO register lock bits - MMIO routing configurationMedium
• Jenkins Eggplant Runner Plugin: clears a JVM-wide proxy protection, exposing Basic credentials over HTTPS tunnelsCVE-2025-64135 · Jenkins Eggplant Runner Plugin (jdk.http.auth.tunneling.disabledSchemes)Medium
• ansible-runner: streamed archive extraction follows symlinks and writes outside the target directoryCVE-2026-103754 · ansible-runner (unstream_dir() in the transmit/worker protocol)Medium
• nfs-utils rpc.statd: memory leak on state notification requests lets a remote attacker exhaust node memoryCVE-2026-89096 · nfs-utils rpc.statd (NSM state notification callback handling)Medium