Minio vulnerabilities

Products

• Minio 31
• Operator 3
• Console 2

Newest

• chainguard minio MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read. CVE-2026-122267 8.8 HighNovember 5, 2026
• minio MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key CVE-2026-113466 6.9 MediumOctober 20, 2026
• minio MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears... CVE-2026-97731 7.1 HighSeptember 25, 2026
• minio MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint CVE-2026-42600 Fix available 6.9 MediumMay 5, 2026
• minio MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads CVE-2026-41145 Fix available 8.8 HighApril 14, 2026
• minio MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads CVE-2026-40344 Fix available 8.8 HighApril 14, 2026
• minio MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing CVE-2026-39414 7.1 HighApril 8, 2026
• minio MinIO is Vulnerable to SSE Metadata Injection via Replication Headers CVE-2026-34204 7.1 HighMarch 27, 2026
• minio MinIO: LDAP login brute-force via user enumeration and missing rate limit CVE-2026-33419 9.1 CriticalMarch 20, 2026
• minio MinIO: JWT Algorithm Confusion in OIDC Authentication CVE-2026-33322 9.2 CriticalMarch 19, 2026
• minio MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS CVE-2025-62506 Public exploitFix available 8.1 HighOctober 16, 2025
• minio minio-java minio-java Client XML Tag is Vulnerable to Value Substitution CVE-2025-59952 Fix available 8.7 HighSeptember 29, 2025
• minio operator OpenAI Operator - API Spoofing through Locking Operator on FullScreen CVE-2025-7021 6.9 MediumJuly 10, 2025
• minio operator Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS CVE-2025-32963 Fix available 6.9 MediumApril 21, 2025
• minio MinIO performs incomplete signature validation for unsigned-trailer uploads CVE-2025-31489 Fix available 8.7 HighApril 3, 2025
• minio MinIO SFTP authentication bypass due to improperly trusted SSH key CVE-2025-27414 Fix available 4.6 MediumFebruary 28, 2025
• minio Privilege escalation in IAM import API in MinIO CVE-2024-55949 Fix available 9.3 CriticalDecember 16, 2024
• canonical operator The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command CVE-2024-41129 Fix available 4.4 MediumJuly 22, 2024
• minio Information disclosure in minio CVE-2024-36107 Fix available 5.3 MediumMay 28, 2024
• minio MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVE-2024-24747 Public exploitFix available EPSS 34.1% 8.8 HighJanuary 31, 2024
• iidk-the-actual console Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited CVE-2023-33955 Fix available 4.3 MediumMay 26, 2023
• minio MinIO is vulnerable to privilege escalation on Linux/MacOS CVE-2023-28434 In KEVPublic exploitFix available 8.8 HighMarch 22, 2023
• minio Minio Privilege Escalation on Windows via Path separator manipulation CVE-2023-28433 Fix available 8.8 HighMarch 22, 2023
• minio Minio Information Disclosure in Cluster Deployment CVE-2023-28432 In KEVPublic exploit EPSS 84.0% 7.5 HighMarch 22, 2023
• minio Minio vulnerable to denial of access by an admin privileged user for root credential CVE-2023-27589 6.5 MediumMarch 14, 2023
• minio Allowed DELETE on resources on object locked buckets under Governance mode in Minio CVE-2023-25812 6.5 MediumFebruary 21, 2023
• minio Authenticated requests for server update admin API allows path traversal in minio CVE-2022-35919 Public exploit EPSS 52.1% 7.4 HighAugust 1, 2022
• minio Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO CVE-2022-31028 7.5 HighJune 3, 2022
• minio Improper Privilege Management in MinIO CVE-2022-24842 8.8 HighApril 12, 2022
• minio User privilege escalation in MinIO CVE-2021-43858 Public exploit EPSS 35.5% 8.8 HighDecember 27, 2021
• iidk-the-actual console, min minio console +1 more Authentication bypass issue in the Operator Console CVE-2021-41266 Fix available EPSS 48.1% 8.6 HighNovember 15, 2021
• minio Bypassing policy restrictions on regular users CVE-2021-41137 8.8 HighOctober 13, 2021
• minio MITM modification of request bodies in MinIO CVE-2021-21390 6.5 MediumMarch 19, 2021
• minio Bypassing readOnly policy by creating a temporary 'mc share upload' URL CVE-2021-21362 7.7 HighMarch 8, 2021
• minio Server-Side Request Forgery in MinIO Browser API CVE-2021-21287 EPSS 23.9% 7.7 HighFebruary 1, 2021
• minio Authentication bypass MinIO Admin API CVE-2020-11012 Fix available 9.3 CriticalApril 23, 2020
• minio Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result… CVE-2018-1000538 7.5 HighJune 26, 2018