Trident v25.02v26.06: LUKS/SMB creds leak via debug logs
CVE-2026-22061 Published on October 9, 2026
CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
Vulnerability Analysis
CVE-2026-22061 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insertion of Sensitive Information Into Debugging Code
The application inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production. When debugging, it may be necessary to report detailed information to the programmer. However, if the debugging code is not disabled when the application is operating in a production environment, then this sensitive information may be exposed to attackers.
Products Associated with CVE-2026-22061
Want to know whenever a new CVE is published for NetApp Trident? stack.watch will email you.
Affected Versions
NetApp Trident:- Version v25.02.1, <= v26.06.1 is affected.