Which versions of Docker are affected by CVE-2026-34204?

CVE-2026-34204 affects MinIO object storage systems, allowing authenticated users with basic write permissions to permanently corrupt data by injecting fraudulent encryption metadata, rendering…

How to fix or mitigate CVE-2026-34204?

Within 24 hours: Inventory all MinIO deployments and identify instances running RELEASE.2024-03-30T09-41-56Z through final open-source release; restrict s3:PutObject permissions to trusted roles only and implement object-level access controls. Within 7 days: Evaluate feasibility of upgrading to MinIO AIStor RELEASE.2026-03-26T21-24-40Z or later; for systems unable to patch, implement bucket replication with immutable object locks and enable audit logging on all PutObject operations. Within 30 days: Complete migration to patched MinIO version or transition to alternative storage solutions; conduct object integrity audits on affected buckets and restore from backups if corruption is detected.

Docker CVE-2026-34204

Q: What is the CVSS score of CVE-2026-34204?

CVE-2026-34204 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Improper Authentication (CWE-287)

2026-03-27 https://github.com/minio/minio

GHSA-3rh2-v3gr-35p9

Authentication Bypass Docker Apple Microsoft

7.1

CVSS 4.0 · Vendor: https://github.com/minio/minio

Severity by source

Vendor (https://github.com/minio/minio) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

HIGH

qualitative

Primary rating from Vendor (https://github.com/minio/minio).

CVSS VectorVendor: https://github.com/minio/minio

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 27, 2026 - 22:46 vuln.today

CVE Published

Mar 27, 2026 - 22:26 nvd

HIGH 7.1

DescriptionCVE.org

Impact

_What kind of vulnerability is it? Who is impacted?_

A flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request. The server unconditionally maps these headers to X-Minio-Internal-* encryption metadata without verifying that the request is a legitimate replication request. Objects written this way carry bogus encryption keys and become permanently unreadable through the S3 API.

Any authenticated user or service with s3:PutObject permission on any bucket can make objects permanently unreadable by injecting fake SSE encryption metadata. The attacker sends a standard PutObject request with X-Minio-Replication-Server-Side-Encryption-* headers but without the X-Minio-Source-Replication-Request header that marks legitimate replication traffic. The server maps these headers to internal encryption metadata (X-Minio-Internal-Server-Side-Encryption-Sealed-Key, etc.), causing all subsequent GetObject and HeadObject calls to treat the object as encrypted with keys that do not exist.

This is a targeted denial-of-service vulnerability. An attacker can selectively corrupt individual objects or entire buckets. The ReplicateObjectAction IAM permission is never checked because the request is a normal PutObject, not a replication request.

Affected component: cmd/handler-utils.go, function extractMetadataFromMime().

Affected Versions

All MinIO releases through the final release of the minio/minio open-source project.

The vulnerability was introduced in commit 468a9fae83e965ecefa1c1fdc2fc57b84ece95b0 ("Enable replication of SSE-C objects", PR #19107, 2024-03-28). The first affected release is RELEASE.2024-03-30T09-41-56Z.

Patches

Fixed in: MinIO AIStor RELEASE.2026-03-26T21-24-40Z

Binary Downloads

Platform	Architecture	Download
Linux	amd64	minio
Linux	arm64	minio
macOS	arm64	minio
macOS	amd64	minio
Windows	amd64	minio.exe

FIPS Binaries

Platform	Architecture	Download
Linux	amd64	minio.fips
Linux	arm64	minio.fips

Package Downloads

Format	Architecture	Download
DEB	amd64	minio_20260326212440.0.0_amd64.deb
DEB	arm64	minio_20260326212440.0.0_arm64.deb
RPM	amd64	minio-20260326212440.0.0-1.x86_64.rpm
RPM	arm64	minio-20260326212440.0.0-1.aarch64.rpm

Container Images

bash

# Standard
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-26T21-24-40Z
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-26T21-24-40Z
# FIPS
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-26T21-24-40Z.fips
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-26T21-24-40Z.fips

Homebrew (macOS)

bash

brew install minio/aistor/minio

Workarounds

Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-03-26T21-24-40Z or later.

If upgrading is not immediately possible:

Restrict replication headers at a reverse proxy / load balancer. Drop or reject any request containing X-Minio-Replication-Server-Side-Encryption-* headers that does not also carry X-Minio-Source-Replication-Request. This blocks the injection path without modifying the server.
Audit IAM policies. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any authorized user can exploit it.

References

Introducing commit: 468a9fae8 (PR #19107)
MinIO AIStor

AnalysisAI

Authentication bypass in MinIO allows any authenticated user with s3:PutObject permission to permanently corrupt objects by injecting fake server-side encryption metadata via crafted X-Minio-Replication-* headers. Attackers can selectively render individual objects or entire buckets permanently unreadable through the S3 API without requiring elevated ReplicateObjectAction permissions. Affects all MinIO releases from RELEASE.2024-03-30T09-41-56Z through the final open-source release. Vendor-released patch available in MinIO AIStor RELEASE.2026-03-26T21-24-40Z. No public exploit identified at time of analysis, though the attack mechanism is well-documented in the advisory.

Technical ContextAI

The vulnerability resides in the extractMetadataFromMime() function within cmd/handler-utils.go of MinIO's object storage server. MinIO implements S3-compatible object storage with support for server-side encryption and cross-site replication. During legitimate replication operations, MinIO uses internal headers (X-Minio-Internal-Server-Side-Encryption-*) to carry encryption metadata between clusters. The flawed code unconditionally maps user-supplied X-Minio-Replication-Server-Side-Encryption-* headers from PutObject requests to these internal encryption metadata fields without validating the presence of X-Minio-Source-Replication-Request, which distinguishes legitimate replication traffic from normal client requests. This CWE-287 (Improper Authentication) flaw means the server trusts client-provided replication headers as if they originated from an authenticated replication source. The injected bogus encryption keys cause the object's metadata to reference non-existent decryption material, making all subsequent GetObject and HeadObject operations fail permanently. The vulnerability was introduced in commit 468a9fae8 (PR #19107, March 2024) when SSE-C replication support was added, affecting the Go-based MinIO server package (pkg:go/github.com_minio_minio).

RemediationAI

Upgrade immediately to MinIO AIStor RELEASE.2026-03-26T21-24-40Z or later, which contains the complete fix for the metadata injection flaw. The patched release is available through multiple distribution channels: direct binary downloads for Linux (amd64/arm64), macOS (amd64/arm64), and Windows (amd64) from dl.min.io, FIPS-compliant binaries for regulated environments, DEB and RPM packages for Debian/Ubuntu and RHEL/CentOS systems, container images via quay.io/minio/aistor/minio:RELEASE.2026-03-26T21-24-40Z (both standard and FIPS variants), and Homebrew installation on macOS (brew install minio/aistor/minio). Community edition users must migrate to MinIO AIStor per the upgrade documentation at docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition. If immediate patching is not feasible, implement a reverse proxy or load balancer rule to reject any HTTP request containing X-Minio-Replication-Server-Side-Encryption-* headers that lacks the accompanying X-Minio-Source-Replication-Request header. Additionally, audit IAM policies to restrict s3:PutObject grants to only trusted principals, though this workaround reduces but does not eliminate risk since any authorized user remains a potential threat actor.