# cve.now: MinIO

The newest entries naming MinIO as an affected vendor (up to 200), of 32 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97731](https://cve.now/CVE-2026-97731.md): MinIO through 7aac2a2 does not verify that every x-amz-\* header present on a request also appears in the client-supplied X-Amz-SignedHeaders (CVSS 7.1)
- [CVE-2026-42600](https://cve.now/CVE-2026-42600.md): MinIO: Path Traversal via msgpack Body in \`ReadMultiple\` Storage-REST Endpoint (CVSS 6.9)
- [CVE-2026-41145](https://cve.now/CVE-2026-41145.md): MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads (CVSS 8.8)
- [CVE-2026-40344](https://cve.now/CVE-2026-40344.md): MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads (CVSS 8.8)
- [CVE-2026-39414](https://cve.now/CVE-2026-39414.md): MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing (CVSS 7.1)
- [CVE-2026-34204](https://cve.now/CVE-2026-34204.md): MinIO is Vulnerable to SSE Metadata Injection via Replication Headers (CVSS 7.1)
- [CVE-2026-33419](https://cve.now/CVE-2026-33419.md): MinIO: LDAP login brute-force via user enumeration and missing rate limit (CVSS 9.1)
- [CVE-2026-33322](https://cve.now/CVE-2026-33322.md): MinIO: JWT Algorithm Confusion in OIDC Authentication (CVSS 9.2)
- [CVE-2025-62506](https://cve.now/CVE-2025-62506.md): MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS (CVSS 8.1)
- [CVE-2025-59952](https://cve.now/CVE-2025-59952.md): minio-java Client XML Tag is Vulnerable to Value Substitution (CVSS 8.7)
- [CVE-2025-32963](https://cve.now/CVE-2025-32963.md): Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS (CVSS 6.9)
- [CVE-2025-31489](https://cve.now/CVE-2025-31489.md): MinIO performs incomplete signature validation for unsigned-trailer uploads (CVSS 8.7)
- [CVE-2025-27414](https://cve.now/CVE-2025-27414.md): MinIO SFTP authentication bypass due to improperly trusted SSH key (CVSS 4.6)
- [CVE-2024-55949](https://cve.now/CVE-2024-55949.md): Privilege escalation in IAM import API in MinIO (CVSS 9.3)
- [CVE-2024-36107](https://cve.now/CVE-2024-36107.md): Information disclosure in minio (CVSS 5.3)
- [CVE-2024-24747](https://cve.now/CVE-2024-24747.md): MinIO unsafe default: Access keys inherit \`admin\` of root user, allowing privilege escalation (CVSS 8.8)
- [CVE-2023-33955](https://cve.now/CVE-2023-33955.md): Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited (CVSS 4.3)
- [CVE-2023-28434](https://cve.now/CVE-2023-28434.md): MinIO is vulnerable to privilege escalation on Linux/MacOS (CVSS 8.8, KEV)
- [CVE-2023-28433](https://cve.now/CVE-2023-28433.md): Minio Privilege Escalation on Windows via Path separator manipulation (CVSS 8.8)
- [CVE-2023-28432](https://cve.now/CVE-2023-28432.md): Minio Information Disclosure in Cluster Deployment (CVSS 7.5, KEV)
- [CVE-2023-27589](https://cve.now/CVE-2023-27589.md): Minio vulnerable to denial of access by an admin privileged user for root credential (CVSS 6.5)
- [CVE-2023-25812](https://cve.now/CVE-2023-25812.md): Allowed DELETE on resources on object locked buckets under Governance mode in Minio (CVSS 6.5)
- [CVE-2022-35919](https://cve.now/CVE-2022-35919.md): Authenticated requests for server update admin API allows path traversal in minio (CVSS 7.4)
- [CVE-2022-31028](https://cve.now/CVE-2022-31028.md): Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO (CVSS 7.5)
- [CVE-2022-24842](https://cve.now/CVE-2022-24842.md): Improper Privilege Management in MinIO (CVSS 8.8)
- [CVE-2021-43858](https://cve.now/CVE-2021-43858.md): User privilege escalation in MinIO (CVSS 8.8)
- [CVE-2021-41266](https://cve.now/CVE-2021-41266.md): Authentication bypass issue in the Operator Console (CVSS 8.6)
- [CVE-2021-41137](https://cve.now/CVE-2021-41137.md): Bypassing policy restrictions on regular users (CVSS 8.8)
- [CVE-2021-21390](https://cve.now/CVE-2021-21390.md): MITM modification of request bodies in MinIO (CVSS 6.5)
- [CVE-2021-21362](https://cve.now/CVE-2021-21362.md): Bypassing readOnly policy by creating a temporary 'mc share upload' URL (CVSS 7.7)
- [CVE-2021-21287](https://cve.now/CVE-2021-21287.md): Server-Side Request Forgery in MinIO Browser API (CVSS 7.7)
- [CVE-2020-11012](https://cve.now/CVE-2020-11012.md): Authentication bypass MinIO Admin API (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/minio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.