Minio
Monthly
Signature-verification bypass in MinIO (all releases through commit 7aac2a2) and in the pgsty/silo fork (before commit 1233254) lets an attacker who holds a valid SigV4 presigned PUT URL - one scoped to a single object - append an unsigned x-amz-copy-source header to the otherwise unmodified URL and cause a server-side CopyObject executed with the signer's credentials, converting a write grant into reads of every object that signing key can reach. The root cause is a CWE-347 improper-verification-of-signature error: extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the client-claimed X-Amz-SignedHeaders list and never enumerates the x-amz-* headers that actually arrived, so an unsigned header is neither hashed into the canonical request nor rejected, while cmd/api-router.go dispatches CopyObject purely on the presence of x-amz-copy-source. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied; exploitation here requires a delegated presigned URL plus a signing key with broader read permission, making this a privilege escalation from a delegated credential rather than unauthenticated access, with no public exploit code or confirmed active exploitation identified at time of analysis.
Authentication bypass in MinIO object storage allows remote attackers to write arbitrary objects to any bucket using only a valid access key, without the corresponding secret key or cryptographic signature. The vulnerability affects MinIO RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z. Attackers can impersonate any user with WRITE permissions by exploiting a logic flaw in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path that incorrectly validates credentials from query parameters while bypassing signature verification. Vendor-released patch available in RELEASE.2026-04-11T03-20-12Z (GitHub commit 76913a9f). No public exploit identified at time of analysis, but exploitation requires only knowledge of a valid access key and target bucket name.
Authentication bypass in MinIO RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z allows remote unauthenticated attackers to write arbitrary objects to any bucket by exploiting an unvalidated auth type in the Snowball auto-extract handler. Attackers need only a valid access key (including the default 'minioadmin') and can fabricate signatures without knowing the secret key. CVSS 8.8 reflects network-accessible, low-complexity exploitation with no authentication required (CVSS:4.0 PR:N). No public exploit identified at time of analysis, but exploitation requires only basic S3 API knowledge. Patched in RELEASE.2026-04-11T03-20-12Z per vendor advisory GHSA-9c4q-hq6p-c237.
Memory exhaustion in MinIO S3 Select (RELEASE.2018-08-18T03-49-57Z through RELEASE.2025-12-20T04-58-37Z) allows authenticated users with s3:PutObject and s3:GetObject permissions to crash the server by uploading CSV files lacking newline characters. The vulnerable CSV reader buffers entire lines into memory without size limits, enabling attackers to trigger out-of-memory conditions. A ~2 MB compressed CSV can decompress to gigabytes without newlines, causing denial of service. No public exploit identified at time of analysis.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can forge Embedded Console session tokens against MinIO deployments built up to RELEASE.2025-10-15T17-29-55Z because the globalDeploymentID/SessionTokenAuthenticate path in cmd/common-main.go signs and validates those tokens with a hard-coded cryptographic key. Per the assessed vector (PR:N/UI:N) no credentials or user interaction are required, and the disclosed proof-of-concept demonstrates an unauthenticated admin takeover rather than mere information disclosure. Publicly available exploit code exists (linked from the VulDB entry), no CISA KEV listing is present, and the maintainer states the affected branch is end-of-life, so only unsupported installations with a network-reachable console are exposed.
Apache CloudStack deployments that use MinIO-backed object storage fail to revoke the MinIO policy associated with a bucket when that bucket is deleted, so a user who previously owned and deleted a bucket retains working access and secret keys. If a different user later creates a new bucket with the identical name, the previous owner can read and write to it using those stale credentials - a form of access-control bypass through incomplete cleanup. The vendor rates it 8.1 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while our independent assessment keeps the impact but raises attack complexity to High because exploitation depends on an externally controlled bucket-name collision. EPSS is low at 0.01% (3rd percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis; vendor-released patches exist as 4.20.3.0 and 4.22.0.1.
Minio Console is the UI for MinIO Object Storage. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Minio is a Multi-Cloud Object Storage framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a multi-cloud object storage solution. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a Kubernetes native application for cloud storage. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Minio is a Kubernetes native application for cloud storage. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under Apache License v2.0. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Minio Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Signature-verification bypass in MinIO (all releases through commit 7aac2a2) and in the pgsty/silo fork (before commit 1233254) lets an attacker who holds a valid SigV4 presigned PUT URL - one scoped to a single object - append an unsigned x-amz-copy-source header to the otherwise unmodified URL and cause a server-side CopyObject executed with the signer's credentials, converting a write grant into reads of every object that signing key can reach. The root cause is a CWE-347 improper-verification-of-signature error: extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the client-claimed X-Amz-SignedHeaders list and never enumerates the x-amz-* headers that actually arrived, so an unsigned header is neither hashed into the canonical request nor rejected, while cmd/api-router.go dispatches CopyObject purely on the presence of x-amz-copy-source. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied; exploitation here requires a delegated presigned URL plus a signing key with broader read permission, making this a privilege escalation from a delegated credential rather than unauthenticated access, with no public exploit code or confirmed active exploitation identified at time of analysis.
Authentication bypass in MinIO object storage allows remote attackers to write arbitrary objects to any bucket using only a valid access key, without the corresponding secret key or cryptographic signature. The vulnerability affects MinIO RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z. Attackers can impersonate any user with WRITE permissions by exploiting a logic flaw in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path that incorrectly validates credentials from query parameters while bypassing signature verification. Vendor-released patch available in RELEASE.2026-04-11T03-20-12Z (GitHub commit 76913a9f). No public exploit identified at time of analysis, but exploitation requires only knowledge of a valid access key and target bucket name.
Authentication bypass in MinIO RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z allows remote unauthenticated attackers to write arbitrary objects to any bucket by exploiting an unvalidated auth type in the Snowball auto-extract handler. Attackers need only a valid access key (including the default 'minioadmin') and can fabricate signatures without knowing the secret key. CVSS 8.8 reflects network-accessible, low-complexity exploitation with no authentication required (CVSS:4.0 PR:N). No public exploit identified at time of analysis, but exploitation requires only basic S3 API knowledge. Patched in RELEASE.2026-04-11T03-20-12Z per vendor advisory GHSA-9c4q-hq6p-c237.
Memory exhaustion in MinIO S3 Select (RELEASE.2018-08-18T03-49-57Z through RELEASE.2025-12-20T04-58-37Z) allows authenticated users with s3:PutObject and s3:GetObject permissions to crash the server by uploading CSV files lacking newline characters. The vulnerable CSV reader buffers entire lines into memory without size limits, enabling attackers to trigger out-of-memory conditions. A ~2 MB compressed CSV can decompress to gigabytes without newlines, causing denial of service. No public exploit identified at time of analysis.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can forge Embedded Console session tokens against MinIO deployments built up to RELEASE.2025-10-15T17-29-55Z because the globalDeploymentID/SessionTokenAuthenticate path in cmd/common-main.go signs and validates those tokens with a hard-coded cryptographic key. Per the assessed vector (PR:N/UI:N) no credentials or user interaction are required, and the disclosed proof-of-concept demonstrates an unauthenticated admin takeover rather than mere information disclosure. Publicly available exploit code exists (linked from the VulDB entry), no CISA KEV listing is present, and the maintainer states the affected branch is end-of-life, so only unsupported installations with a network-reachable console are exposed.
Apache CloudStack deployments that use MinIO-backed object storage fail to revoke the MinIO policy associated with a bucket when that bucket is deleted, so a user who previously owned and deleted a bucket retains working access and secret keys. If a different user later creates a new bucket with the identical name, the previous owner can read and write to it using those stale credentials - a form of access-control bypass through incomplete cleanup. The vendor rates it 8.1 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while our independent assessment keeps the impact but raises attack complexity to High because exploitation depends on an externally controlled bucket-name collision. EPSS is low at 0.01% (3rd percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis; vendor-released patches exist as 4.20.3.0 and 4.22.0.1.
Minio Console is the UI for MinIO Object Storage. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Minio is a Multi-Cloud Object Storage framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a multi-cloud object storage solution. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a Kubernetes native application for cloud storage. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Minio is a Kubernetes native application for cloud storage. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
MinIO is a High Performance Object Storage released under Apache License v2.0. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Minio Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.