# github.com/minio/minio (Go) vulnerabilities

15 known vulnerabilities (3 critical, 9 high, 3 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/minio/minio

## Advisories (15)

### [CVE-2026-42600](https://cve.now/CVE-2026-42600): MinIO: Path Traversal via msgpack Body in \`ReadMultiple\` Storage-REST Endpoint

- Severity: Medium 6.9
- Published: May 11, 2026
- Affected: all versions; from 0.0.0-20220724015452, fixed in 0.0.0-20260414213245.

### [CVE-2026-41145](https://cve.now/CVE-2026-41145): MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

- Severity: High 8.8
- Published: Apr 22, 2026
- Affected: from 0.0.0-20230506025312-76913a9fd5c6, through 0.0.0-20260212201848-7aac2a2c5b7c; from 0.0.0-20230506025312-76913a9fd5c6.

### [CVE-2026-40344](https://cve.now/CVE-2026-40344): MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

- Severity: High 8.8
- Published: Apr 22, 2026
- Affected: from 0.0.0-20230506025312-76913a9fd5c6; from 0.0.0-20230506025312-76913a9fd5c6, through 0.0.0-20260212201848-7aac2a2c5b7c.

### [CVE-2026-39414](https://cve.now/CVE-2026-39414): MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

- Severity: High 7.1
- Published: Apr 8, 2026
- Affected: from 0.0.0-20180815103019-7c14cdb60e53.

### [CVE-2026-34204](https://cve.now/CVE-2026-34204): MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

- Severity: High 7.1
- Published: Mar 31, 2026
- Affected: from 0.0.0-20240328174456-468a9fae83e9, through 0.0.0-20260212201848-7aac2a2c5b7c; from 0.0.0-20240328174456-468a9fae83e9.

### [CVE-2026-33419](https://cve.now/CVE-2026-33419): MinIO: LDAP login brute-force via user enumeration and missing rate limit

- Severity: Critical 9.1
- Published: Mar 24, 2026
- Affected: through 0.0.0-20260212201848-7aac2a2c5b7c; all versions.

### [CVE-2026-33322](https://cve.now/CVE-2026-33322): MinIO: JWT Algorithm Confusion in OIDC Authentication

- Severity: Critical 9.2
- Published: Mar 24, 2026
- Affected: through 0.0.0-20260212201848-7aac2a2c5b7c; all versions.

### [CVE-2025-62506](https://cve.now/CVE-2025-62506): MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

- Severity: High 8.1
- Published: Oct 16, 2025
- Affected: fixed in 0.0.0-20251015170045-c1a49490c78e.

### [CVE-2025-31489](https://cve.now/CVE-2025-31489): MinIO performs incomplete signature validation for unsigned-trailer uploads

- Severity: High 8.7
- Published: Apr 3, 2025
- Affected: fixed in 0.0.0-20250403145552-8c70975283f9.

### [CVE-2025-27414](https://cve.now/CVE-2025-27414): MinIO SFTP authentication bypass due to improperly trusted SSH key

- Severity: Medium 4.6
- Published: Feb 28, 2025
- Affected: all versions; from 0.0.0-20240605075113-91e1487de457, fixed in 0.0.0-20250227184332-4c71f1b4ec0f.

### [CVE-2024-55949](https://cve.now/CVE-2024-55949): Privilege escalation in IAM import API in MinIO

- Severity: Critical 9.3
- Published: Dec 16, 2024
- Affected: from 0.0.0-20220623162515-580d9db85e04, fixed in 0.0.0-20241213221912-68b004a48f41.

### [CVE-2024-36107](https://cve.now/CVE-2024-36107): Information disclosure in minio

- Severity: Medium 5.3
- Published: May 28, 2024
- Affected: fixed in 0.0.0-20240527191746-e0fe7cc39172.

### [CVE-2024-24747](https://cve.now/CVE-2024-24747): MinIO unsafe default: Access keys inherit \`admin\` of root user, allowing privilege escalation

- Severity: High 8.8
- Published: Jan 31, 2024
- Affected: fixed in 0.0.0-20240131185645-0ae4915a9391.

### [CVE-2023-28434](https://cve.now/CVE-2023-28434): MinIO is vulnerable to privilege escalation on Linux/MacOS

- Severity: High 8.8 · KEV
- Published: Mar 22, 2023
- Affected: fixed in 0.0.0-202303200415.

### [CVE-2023-28433](https://cve.now/CVE-2023-28433): Minio Privilege Escalation on Windows via Path separator manipulation

- Severity: High 8.8
- Published: Mar 22, 2023
- Affected: fixed in 0.0.0-202303200735.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/minio/minio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.