- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 15 · 3 critical, 9 high, 3 medium
- Registry
- pkg.go.dev
Advisories 15
- CVE-2026-42600Medium 6.9
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
Affected: all versions; from 0.0.0-20220724015452, fixed in 0.0.0-20260414213245.
- CVE-2026-41145High 8.8
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
Affected: from 0.0.0-20230506025312-76913a9fd5c6, through 0.0.0-20260212201848-7aac2a2c5b7c; from 0.0.0-20230506025312-76913a9fd5c6.
- CVE-2026-40344High 8.8
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
Affected: from 0.0.0-20230506025312-76913a9fd5c6; from 0.0.0-20230506025312-76913a9fd5c6, through 0.0.0-20260212201848-7aac2a2c5b7c.
- CVE-2026-39414High 7.1
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
Affected: from 0.0.0-20180815103019-7c14cdb60e53.
- CVE-2026-34204High 7.1
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
Affected: from 0.0.0-20240328174456-468a9fae83e9, through 0.0.0-20260212201848-7aac2a2c5b7c; from 0.0.0-20240328174456-468a9fae83e9.
- CVE-2026-33419Critical 9.1
MinIO: LDAP login brute-force via user enumeration and missing rate limit
Affected: through 0.0.0-20260212201848-7aac2a2c5b7c; all versions.
- CVE-2026-33322Critical 9.2
MinIO: JWT Algorithm Confusion in OIDC Authentication
Affected: through 0.0.0-20260212201848-7aac2a2c5b7c; all versions.
- CVE-2025-62506High 8.1
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
Affected: fixed in 0.0.0-20251015170045-c1a49490c78e.
- CVE-2025-31489High 8.7
MinIO performs incomplete signature validation for unsigned-trailer uploads
Affected: fixed in 0.0.0-20250403145552-8c70975283f9.
- CVE-2025-27414Medium 4.6
MinIO SFTP authentication bypass due to improperly trusted SSH key
Affected: all versions; from 0.0.0-20240605075113-91e1487de457, fixed in 0.0.0-20250227184332-4c71f1b4ec0f.
- CVE-2024-55949Critical 9.3
Privilege escalation in IAM import API in MinIO
Affected: from 0.0.0-20220623162515-580d9db85e04, fixed in 0.0.0-20241213221912-68b004a48f41.
- CVE-2024-36107Medium 5.3
Information disclosure in minio
Affected: fixed in 0.0.0-20240527191746-e0fe7cc39172.
- CVE-2024-24747High 8.8
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
Affected: fixed in 0.0.0-20240131185645-0ae4915a9391.
- CVE-2023-28434High 8.8 · KEV
MinIO is vulnerable to privilege escalation on Linux/MacOS
Affected: fixed in 0.0.0-202303200415.
- CVE-2023-28433High 8.8
Minio Privilege Escalation on Windows via Path separator manipulation
Affected: fixed in 0.0.0-202303200735.