minio vulnerabilities

Products

• minio 30
• github.com/minio/console 2
• github.com/minio/operator 1
• minio-java 1

Latest minio CVEs

Newest publication first · page 1 of 2

1. CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

   Published 2026-10-20

   Medium·CVSS 6.9 EPSS 0.38%

   A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded crypt...

2. CVE-2026-97731 MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go i...

   Published 2026-09-25

   High·CVSS 7.1 EPSS 0.17%

   MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arr...

3. CVE-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

   Published 2026-05-11

   Medium·CVSS 6.9 EPSS 8.7%

   MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outs...

4. CVE-2026-41145 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

   Published 2026-04-22

   High·CVSS 8.8 EPSS 0.35%

   MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to wr...

5. CVE-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

   Published 2026-04-22

   High·CVSS 8.8 EPSS 0.42%

   MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (PutObjectExtractHandler) allows any user who knows a valid acces...

6. CVE-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

   Published 2026-04-08

   High·CVSS 7.1 EPSS 0.50%

   MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's next...

7. CVE-2026-34204 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

   Published 2026-03-31

   High·CVSS 7.1 EPSS 0.13%

   MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Mi...

8. CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit

   Published 2026-03-24

   Critical·CVSS 9.1 EPSS 0.47%

   MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error respo...

9. CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication

   Published 2026-03-24

   Critical·CVSS 9.2 EPSS 0.43%

   MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary iden...

10. CVE-2025-62506 MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

    Published 2025-10-16

    High·CVSS 8.1 EPSS 0.57%

    MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrict...

11. CVE-2025-59952 minio-java Client XML Tag is Vulnerable to Value Substitution

    Published 2025-09-29

    High·CVSS 8.7 EPSS 0.49%

    MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were au...

12. CVE-2025-32963 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

    Published 2025-04-22

    Medium·CVSS 6.9 EPSS 0.63%

    MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the spec.audiences field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintenti...

13. CVE-2025-31489 MinIO performs incomplete signature validation for unsigned-trailer uploads

    Published 2025-04-03

    High·CVSS 8.7 EPSS 2.5%

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRI...

14. CVE-2025-27414 MinIO SFTP authentication bypass due to improperly trusted SSH key

    Published 2025-02-28

    Medium·CVSS 4.6 EPSS 0.59%

    MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO s...

15. CVE-2024-55949 Privilege escalation in IAM import API in MinIO

    Published 2024-12-16

    Critical·CVSS 9.3 EPSS 0.61%

    MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commi...

16. CVE-2024-36107 Information disclosure in minio

    Published 2024-05-28

    Medium·CVSS 5.3 EPSS 0.63%

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on th...

17. CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

    Published 2024-01-31

    High·CVSS 8.8 EPSS 34.1%

    MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3:* actions, but also admin:* actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access...

18. CVE-2023-33955 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

    Published 2023-05-30

    Medium·CVSS 5.3 EPSS 0.65%

    Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.

19. CVE-2023-28434 MinIO is vulnerable to privilege escalation on Linux/MacOS

    Published 2023-03-22

    High·CVSS 8.8 EPSS 7.9% CISA KEV added 2023-09-19 Exploited in the wild

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker require...

20. CVE-2023-28433 Minio Privilege Escalation on Windows via Path separator manipulation

    Published 2023-03-22

    High·CVSS 8.8 EPSS 0.98%

    Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the \ character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an...

21. CVE-2023-28432 Minio Information Disclosure in Cluster Deployment

    Published 2023-03-22

    High·CVSS 7.5 EPSS 84.0% CISA KEV added 2023-04-21 Exploited in the wild Framework module

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information dis...

22. CVE-2023-27589 Minio vulnerable to denial of access by an admin privileged user for root credential

    Published 2023-03-14

    Medium·CVSS 6.5 EPSS 0.90%

    Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successf...

23. CVE-2023-25812 Allowed DELETE on resources on object locked buckets under Governance mode in Minio

    Published 2023-02-21

    High·CVSS 8.8 EPSS 0.96%

    Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a Deny policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header X-Amz-Bypass-Governance-Retention: true....

24. CVE-2022-35919 Authenticated requests for server update admin API allows path traversal in minio

    Published 2022-08-01

    Low·CVSS 2.7 EPSS 52.1%

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS s...

25. CVE-2022-31028 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

    Published 2022-06-03

    High·CVSS 7.5 EPSS 3.0%

    MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.