Every CVE Search/ Get API key

CVE-2020-11012

Authentication bypass MinIO Admin API

9.3 CriticalFix available

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

1.87%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 9.3

Authentication bypass MinIO Admin API

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Record
CVE-2020-11012
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-305
Updated
2026-11-02
EUVDEUVD-2020-3402 9.3

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Record
EUVD-2020-3402
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-xv4r-vccv-mg4w 7.1

MinIO Admin API security issue

During an internal security audit, we detected an authentication bypass issue in the MinIO admin API. The security issue has been reported internally. We have not observed this exploit in the wild or reported elsewhere in the community at large. All users are advised to upgrade ASAP.

Impact

Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys without knowing the admin secret key. This security issue was found during a regular internal security audit.

Patches

This issue was fixed by @vadmeste in PR https://github.com/minio/minio/pull/9422

Binary Download

Please download the latest server binary that contains the fix from

| Platform | Architecture | URL | | ---------- | -------- | ------ | | Apple macOS | 64-bit Intel | https://dl.min.io/server/minio/release/darwin-amd64/minio | | GNU/Linux | 64-bit Intel | https://dl.min.io/server/minio/release/linux-amd64/minio | | Microsoft Windows | 64-bit | https://dl.min.io/server/minio/release/windows-amd64/minio.exe |

Docker Container Download

docker pull minio/minio:RELEASE.2020-04-23T00-58-49Z

Questions

If you have any questions or comments regarding this advisory please reach out to us any of the following means.

Record
GHSA-xv4r-vccv-mg4w
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-287, CWE-305, CWE-755
Updated
2026-11-02
NVD 9.3

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Record
CVE-2020-11012
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-305, CWE-755
Updated
2026-11-02
OSVALPINE-CVE-2020-11012 7.5

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Record
ALPINE-CVE-2020-11012
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 7.5

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Record
CVE-2020-11012
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
minio
Alpine:v3.17
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.18
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.19
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.20
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.21
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.22
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.23
 before 0.20200423-r0
0.20200423-r0
minio
Alpine:v3.24
 before 0.20200423-r0
0.20200423-r0

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11012 is a critical vulnerability (CVSS 9.3) in Minio, published April 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. Fixed in minio 0.20200423-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open