NetApp Trident EUVD-2026-96020

Exploitation requires two concrete prerequisites: (1) an authenticated foothold at low privilege (PR:L), and (2) read access to Trident's debug logs on the host/cluster. The sensitive values only appear when the corresponding features are in use - LUKS-encrypted volumes (which generate LUKS passphrases) and/or SMB shares joined to Active Directory (which store AD credentials). Limiting factors that reduce realistic risk: the attack vector is LOCAL (AV:L), not network-remote; the attacker cannot be fully anonymous (authentication/low privilege needed); and debug-level logging plus access to those logs must be present, which is not guaranteed in a least-privilege, non-debug production configuration. Affected only for Trident v25.02.1 through v26.06.1.

Signals are consistent and point to a genuine but non-urgent, privilege-and-configuration-gated exposure rather than a mass-exploitation threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 8.2) is internally coherent with the description: local attack vector, low existing privileges (authenticated), no user interaction, and high confidentiality impact that propagates to subsequent systems (SC:H) because what leaks are credentials for OTHER systems - LUKS disk-encryption passphrases and SMB Active Directory credentials - not Trident's own data. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the supplied data, so this is not confirmed as actively exploited and there is no evidence of weaponization. The 8.2 base score is elevated mainly by the credential-disclosure/scope impact, but real-world risk is tempered by the prerequisites: the attacker must already be authenticated AND have access to Trident debug logs, which are not typically world-readable in a hardened deployment. Net assessment: treat as a meaningful information-disclosure/credential-exposure issue to patch on a normal cycle, not an emergency, absent any exploitation evidence. Key limitation: the input gives no EPSS, so widespread-exploitation probability cannot be quantified from the data provided.

An attacker who already holds low-privileged authenticated access to the Kubernetes/storage environment reads NetApp Trident debug logs and extracts plaintext LUKS volume passphrases and/or SMB Active Directory credentials written there. Using those recovered credentials, the attacker then decrypts protected volumes or authenticates to Active Directory/SMB resources, pivoting to systems beyond Trident itself. No public exploit is required because the data is exposed in the logs by design flaw (CWE-215); exploitation is a matter of log access, not a crafted payload.