CVE-2026-22061: CWE-215 Insertion of sensitive information into debugging code in NetApp Trident

CVE-2026-22061 affects NetApp Trident versions 25.02.1 through 26.06.1. The vulnerability involves the insertion of sensitive information (LUKS passphrases and SMB Active Directory credentials) into debug logs, which can be accessed by an authenticated attacker with appropriate privileges. This exposure arises from improper handling of sensitive data in debugging code, categorized under CWE-215. The CVSS 4.0 vector indicates local attack vector with low complexity and no user interaction required, but privileges are needed to access debug logs. Confidentiality impact is high due to exposure of sensitive credentials.

An authenticated attacker with access to debug logs can obtain highly sensitive credentials, including LUKS passphrases and SMB Active Directory credentials. This exposure could lead to unauthorized access to encrypted volumes or Active Directory resources, significantly compromising system security and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should restrict access to debug logs to trusted administrators only and avoid enabling verbose debugging in production environments until a fix is available.