MinIO CVE-2026-113466

Requires a reachable MinIO Embedded Console on an affected build (MinIO up to RELEASE.2025-10-15T17-29-55Z) where the SessionTokenAuthenticate path signs/validates session tokens using a hard-coded cryptographic key derived from globalDeploymentID. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so default network-exposed consoles are at risk. Limiting factors: exploitation targets the Embedded Console component specifically, so deployments that do not expose the console to untrusted networks, that disable it, or that run patched/newer releases reduce or remove exposure; the input also claims the affected branch is end-of-life, which (if accurate) scopes impact to unsupported installations.

Signals are mixed and the headline score likely understates real risk. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which is consistent with a hard-coded cryptographic key (CWE-321) being usable by anyone who knows it. However, the input rates impact as confidentiality-only and low (VC:L, VI:N, VA:N), producing a score of 6.9, while the referenced public exploit is explicitly titled 'unauth_admin_takeover' - forging session tokens from a hard-coded/predictable signing key (derived from globalDeploymentID in SessionTokenAuthenticate) would yield full administrative control of the object store, implying high confidentiality AND integrity (and plausibly availability) impact. This is a CONFLICT: the metadata impact (VC:L) contradicts the POC's admin-takeover claim - verify the true blast radius before deprioritizing on the 6.9 score alone. Public exploit code exists (E:P), raising near-term exploitation likelihood, but there is no CISA KEV listing and no EPSS value supplied, so active exploitation is NOT confirmed. Net: if the admin-takeover claim holds, this is a genuine high-priority issue for internet-exposed MinIO consoles despite the moderate published CVSS.

An attacker who can reach a MinIO Embedded Console over the network uses the hard-coded cryptographic key to forge a valid session/JWT token without any credentials, then authenticates to the console as an administrator. A public exploit ('unauth_admin_takeover') is available, and because the attack is network-based and low-complexity (AV:N/AC:L/PR:N/UI:N), it can be executed remotely with no user interaction against affected releases.