MinIO vulnerabilities
32 CVEs and advisories name MinIO as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-97731MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders
- CVE-2026-42600MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
- CVE-2026-41145MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
- CVE-2026-40344MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
- CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
- CVE-2026-34204MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
- CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-33322MinIO: JWT Algorithm Confusion in OIDC Authentication
- CVE-2025-62506MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
- CVE-2025-59952minio-java Client XML Tag is Vulnerable to Value Substitution
- CVE-2025-32963Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
- CVE-2025-31489MinIO performs incomplete signature validation for unsigned-trailer uploads
- CVE-2025-27414MinIO SFTP authentication bypass due to improperly trusted SSH key
- CVE-2024-55949Privilege escalation in IAM import API in MinIO
- CVE-2024-36107Information disclosure in minio
- CVE-2024-24747MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
- CVE-2023-33955Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
- CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOS
- CVE-2023-28433Minio Privilege Escalation on Windows via Path separator manipulation
- CVE-2023-28432Minio Information Disclosure in Cluster Deployment
- CVE-2023-27589Minio vulnerable to denial of access by an admin privileged user for root credential
- CVE-2023-25812Allowed DELETE on resources on object locked buckets under Governance mode in Minio
- CVE-2022-35919Authenticated requests for server update admin API allows path traversal in minio
- CVE-2022-31028Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO
- CVE-2022-24842Improper Privilege Management in MinIO
- CVE-2021-43858User privilege escalation in MinIO
- CVE-2021-41266Authentication bypass issue in the Operator Console
- CVE-2021-41137Bypassing policy restrictions on regular users
- CVE-2021-21390MITM modification of request bodies in MinIO
- CVE-2021-21362Bypassing readOnly policy by creating a temporary 'mc share upload' URL