StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to an information disclosure vulnerability. The flaw allows an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that the attacker should not have access to. This leads to the accidental exposure of potentially sensitive operational data, compromising confidentiality of the system's telemetry and performance metrics.

The affected systems are NetApp StorageGRID deployments, specifically any installations running versions older than 11.9.0.13 or 12.0.0.6. This includes all environments that have not been updated to the specified patched releases.

The CVSS score of 2.3 indicates a low severity impact, yet the vulnerability is exploitable by an authenticated user, which is common in managed storage environments. The exploit mechanism relies on the internal metrics API; thus the attack vector is assumed to be internal or local. As the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation is considered low but not negligible. The primary risk is the unauthorized disclosure of metrics data to users who do not possess the correct permissions.