Netapp Trident vulnerabilities

12 CVEs affecting Netapp Trident, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22061, published 2026-10-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1002105, published 2018-12-05. Critical severity, CVSS 9.8. EPSS: 87% chance of exploitation in the next 30 days. In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to…
CVE-2019-9514, published 2019-08-13. High severity, CVSS 7.5. EPSS: 82.8% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that…
CVE-2021-34558, published 2021-07-15. Medium severity, CVSS 6.5. EPSS: 7% chance of exploitation in the next 30 days. The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a…
CVE-2020-28362, published 2020-11-18. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-28366, published 2020-11-18. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVE-2020-29509, published 2020-12-14. Medium severity, CVSS 5.6. EPSS: 2.1% chance of exploitation in the next 30 days. The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that…
CVE-2020-29510, published 2020-12-14. Medium severity, CVSS 5.6. EPSS: 2.1% chance of exploitation in the next 30 days. The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave…
CVE-2021-25742, published 2021-10-29. High severity, CVSS 7.1. EPSS: 2.1% chance of exploitation in the next 30 days. A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
CVE-2020-29511, published 2020-12-14. Medium severity, CVSS 5.6. EPSS: 2% chance of exploitation in the next 30 days. The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that…
CVE-2019-11243, published 2019-04-22. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client…

Latest

CVE-2026-22061, published 2026-10-09. High severity, CVSS 8.2. EPSS: 0.1% chance of exploitation in the next 30 days. Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory…
CVE-2019-11244, published 2019-04-22. Medium severity, CVSS 5.0. EPSS: 0.5% chance of exploitation in the next 30 days. In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-).…