WebAuthn MFA authentication bypass in NetApp ONTAP

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

NetApp ONTAP 9 is affected when WebAuthn MFA is configured:

• From 9.16.1 through versions less than 9.19.1.

The record sets default_status to unaffected outside the listed affected interval. However, the available evidence does not independently establish the status of every parallel release branch or later branch beyond that boundary.

NetApp identifies the flaw as related to handling the WebAuthn Relying Party ID. If the affected condition is triggered, a requester with valid ONTAP credentials may be able to proceed without the intended MFA assurance. The available evidence does not establish whether the defect involves deriving, comparing, scoping, or binding the Relying Party ID to a credential, so the exact implementation failure and exploit sequence remain unknown.

The record characterizes the attack as network-reachable, requiring valid credentials and no user interaction. It does not specify the role or permission level represented by those credentials, nor does it identify the management endpoint that directly processes the flawed request. The supported scope is ONTAP 9 with WebAuthn MFA configured and a version within the affected interval.

Exploitation may be performed remotely over the network and requires the attacker to possess valid credentials. The supplied record characterizes the attack as requiring no user interaction and having low complexity, but it provides no endpoint, request format, or specific exploit sequence.

The supplied record marks public exploit as false and does not confirm an exploited-in-the-wild status. That does not prove exploitation has not occurred; the detailed exploitation method and evidence of real-world abuse remain unknown in the available data.

Successful exploitation could allow a person who already has valid credentials to access the system without completing WebAuthn MFA as intended. The resulting consequence depends on the account's authorization and may include reading or changing data, modifying configuration, or affecting service operation within that authorization scope.

The flaw does not itself provide credentials to the attacker; possession of valid credentials remains a stated precondition. The post-bypass privilege scope and the specific actions available to an attacker are not established by the available evidence.

Successful exploitation could weaken MFA, which is an additional control intended to protect accounts after the primary credential has been presented. An attacker may gain access to functions, data, or administrative actions that the valid account is authorized to use.

The practical consequence depends on the privileges of the abused credential and the organization's ONTAP configuration. The record does not provide evidence of a specific intrusion, data breach, or unauthorized change, but bypassing MFA could substantially increase the consequences of exposed credentials.

1. Upgrade deployments in the interval from 9.16.1 through versions less than 9.19.1 so that they are outside the affected range. 9.19.1 is the first boundary explicitly represented in the structured data as outside the affected interval.
2. Before deployment, confirm the target release branch and upgrade path against current NetApp guidance. Do not infer that every later or parallel branch is covered solely from the 9.19.1 boundary.
3. If an upgrade cannot be completed immediately, consult the NetApp advisory for a mitigation appropriate to the installed branch. The supplied record does not provide a validated workaround, so configuration changes to authentication should not be treated as a confirmed fix.
4. After remediation, review authentication activity and privileged-account activity for unusual sessions or actions. If credential misuse is suspected, follow the organization's incident response process and protect the affected accounts.

1. Inventory all NetApp ONTAP deployments and compare their versions with the affected interval in affected_summary.
2. Identify clusters or deployments with WebAuthn MFA enabled. Review the configured Relying Party ID through a NetApp-supported administrative interface if that value is exposed.
3. Review authentication records for successful sessions involving accounts expected to use WebAuthn MFA but lacking corresponding evidence of MFA verification. Treat this as precautionary monitoring, not as a confirmed indicator of compromise.
4. Audit post-authentication activity for privileged accounts, including unusual configuration changes, data access, or administrative actions. The absence of suspicious log activity does not prove that a system is safe.