{"id":"CVE-2021-43858","aliases":["EUVD-2021-30723","GHSA-j6jc-jqqc-p6cx"],"status":"published","title":"User privilege escalation in MinIO","description":"MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.35462,"percentile":0.98465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269","CWE-863"],"published":"2021-12-27T21:20:11Z","modified":"2026-10-20T10:55:04Z","exploits":[{"source":"pocgithub","id":"0rx1/cve-2021-43858","title":"0rx1/cve-2021-43858","date":"2022-01-03","url":"https://github.com/0rx1/cve-2021-43858"},{"source":"pocgithub","id":"khuntor/CVE-2021-43858-MinIO","title":"khuntor/CVE-2021-43858-MinIO","date":"2023-04-12","url":"https://github.com/khuntor/CVE-2021-43858-MinIO"}],"products":[{"vendor":"minio","product":"minio"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/minio/minio/pull/13976","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/minio/minio/pull/7949","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]}],"sources":{"cve":[{"id":"CVE-2021-43858","title":"User privilege escalation in MinIO","description":"MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.","status":"published","published":"2021-12-27T21:20:11Z","modified":"2024-08-04T04:10:17.197Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2021-30723","description":"MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.","status":"published","published":"2021-12-27T21:20:11Z","modified":"2024-08-04T04:10:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:12.599691Z"}],"nvd":[{"id":"CVE-2021-43858","description":"MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.","status":"published","published":"2021-12-27T22:15:07.703Z","modified":"2026-06-17T04:11:35.25Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"CVE-2021-43858","description":"MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.","status":"published","published":"2021-12-27T22:15:07.703Z","modified":"2026-10-20T10:55:04.569927834Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"}]}}