MinIO CVE-2026-41145

Exploitation requires the attacker to possess a valid MinIO access key (the public component of the credential pair) for an account with WRITE permissions on the target bucket-this includes the well-known default access key 'minioadmin' if not changed, or any user-created access key with s3:PutObject grants. The target MinIO server must be running a vulnerable version (RELEASE.2023-05-18T00-05-36Z through pre-RELEASE.2026-04-11T03-20-12Z) and must be network-accessible to the attacker (AV:N). Critically, the attacker does NOT need the corresponding secret key, does NOT need to generate valid cryptographic signatures, and does NOT need any prior authentication beyond knowing the access key string. The vulnerability is exploitable against default MinIO configurations without enabling any special features. Exploitation is limited only by network reachability and knowledge of a valid access key-no user interaction (UI:N), no elevated privileges (PR:N), and low attack complexity (AC:L) make this broadly exploitable.

This vulnerability presents critical real-world risk despite no confirmed active exploitation. The CVSS 4.0 score of 8.8 with vector AV:N/AC:L/PR:N reflects remote exploitability with low attack complexity and no privileges required, though VI:H (high integrity impact) indicates the primary impact is unauthorized data modification rather than confidentiality breach. The attack requires only knowledge of a valid access key-commonly the default 'minioadmin' credential that organizations frequently fail to change-making it highly accessible to both external attackers who discover leaked keys and insider threats. No public exploit code exists per available data, but the technical details in the GitHub advisory (GHSA-hv4r-mvr4-25vw) provide sufficient information for skilled attackers to develop exploits. The vulnerability is not in CISA KEV, suggesting no widespread exploitation detected, but the combination of trivial exploitation requirements (just a valid access key) and severe impact (arbitrary object writes to any bucket) makes this a priority for any organization running affected MinIO versions. The three-year vulnerable window (2023-2026 releases) means a substantial install base is exposed. Exploitation is highly automatable once an access key is obtained through credential stuffing, configuration leaks, or social engineering.

An attacker obtains a valid MinIO access key through credential leaks, default credentials (minioadmin), or phishing. They craft an HTTP PUT request to upload a malicious object to a target bucket, omitting the Authorization header entirely and instead providing the access key via the X-Amz-Credential query parameter with the header X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER. MinIO's signature verification logic is bypassed because it only checks for the Authorization header presence, yet the permission check extracts and trusts the query-string credentials, granting write access without validating the secret key. The attacker uploads ransomware payloads, malicious firmware updates, or tampered data files to production buckets.