MinIO

Records33All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high21CVSS 7.0–8.9

Exploited now

MinIO records in CISA KEV

TI-2023-12978 MinIO Security Feature Bypass Vulnerability CRITICAL 97KEV 2023-09-19 TI-2023-12976 MinIO Information Disclosure Vulnerability CRITICAL 90KEV 2023-04-21

Components

Products in the NVD configurations · select one to filter the records

Minio 23 records CRITICAL Console 1 record LOW

Records

33 records

TI-2023-12978 CVE-2023-28434 · GHSA-2pxw-r47w-4p8c

MinIO is vulnerable to privilege escalation on Linux/MacOS

CRITICAL 97KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07917 Published 2023-03-22 Fixed in 0.0.0-202303200415 CWE-269

TI-2023-12976 CVE-2023-28432

Minio Information Disclosure in Cluster Deployment

CRITICAL 90KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83957 Published 2023-03-22 No fix listed CWE-200

TI-2023-11082 CVE-2023-25812

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

HIGH 77

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00955 Published 2023-02-21 No fix listed CWE-281

TI-2024-16264 CVE-2024-24747 · GHSA-xx8w-mq23-29g4

MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

HIGH 73

MinIO is a High Performance Object Storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.34086 Published 2024-01-31 Fixed in 0.0.0-20240131185645-0ae4915a9391 CWE-269

TI-2022-08654 CVE-2022-24842

Improper Privilege Management in MinIO

HIGH 73

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02117 Published 2022-04-12 No fix listed CWE-269

TI-2021-18098 CVE-2021-41266 · GHSA-4999-659w-mq36

Authentication bypass issue in the Operator Console

HIGH 73

Minio console is a graphical user interface for the for MinIO operator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48134 Published 2021-11-15 Fixed in 0.12.3 CWE-306

TI-2022-13073 CVE-2022-31028

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

HIGH 72

MinIO is a multi-cloud object storage solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03043 Published 2022-06-03 No fix listed CWE-400

TI-2022-16346 CVE-2022-35919

Authenticated requests for server update admin API allows path traversal in minio

HIGH 66

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.52144 Published 2022-08-01 No fix listed CWE-22

TI-2021-19664 CVE-2021-43858

User privilege escalation in MinIO

MEDIUM 64

MinIO is a Kubernetes native application for cloud storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.35462 Published 2021-12-27 Partial fix CWE-269

TI-2021-04387 CVE-2021-21287

Server-Side Request Forgery in MinIO Browser API

MEDIUM 54

MinIO is a High Performance Object Storage released under Apache License v2.0.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.23896 Published 2021-02-01 No fix listed CWE-918

TI-2025-22670 CVE-2025-31489 · GHSA-wg47-6jq2-q2hh

MinIO performs incomplete signature validation for unsigned-trailer uploads

MEDIUM 48

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02519 Published 2025-04-03 Fixed in 0.0.0-20250403145552-8c70975283f9 CWE-347

TI-2026-25816 CVE-2026-33419 · GHSA-jv87-32hw-hh99

MinIO: LDAP login brute-force via user enumeration and missing rate limit

MEDIUM 46

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00456 Published 2026-03-24 No fix listed CWE-204

TI-2026-29119 CVE-2026-40344 · GHSA-9c4q-hq6p-c237

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

MEDIUM 44

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00418 Published 2026-04-22 No fix listed CWE-287

TI-2025-37340 CVE-2025-59952 · GHSA-h7rh-xfpj-hpcm

minio-java Client XML Tag is Vulnerable to Value Substitution

MEDIUM 44

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00491 Published 2025-09-29 Partial fix · 8.6.0 CWE-20

TI-2020-08886 CVE-2020-11012 · GHSA-xv4r-vccv-mg4w

Authentication bypass MinIO Admin API

MEDIUM 44

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.01872 Published 2020-04-23 No fix listed CWE-305

TI-2024-36990 CVE-2024-55949 · GHSA-cwq8-g58r-32hg

Privilege escalation in IAM import API in MinIO

MEDIUM 43

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00608 Published 2024-12-16 Fixed in 0.0.0-20241213221912-68b004a48f41 CWE-269

TI-2026-30880 CVE-2026-42600 · GHSA-xh8f-g2qw-gcm7

MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.08695 Published 2026-05-11 Fixed in 0.0.0-20260414213245 CWE-22

TI-2026-25733 CVE-2026-33322 · GHSA-5cx5-wh4m-82fh

MinIO: JWT Algorithm Confusion in OIDC Authentication

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00425 Published 2026-03-24 No fix listed CWE-287

TI-2023-12977 CVE-2023-28433 · GHSA-w23q-4hw3-2pp6

Minio Privilege Escalation on Windows via Path separator manipulation

MEDIUM 42

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00981 Published 2023-03-22 Fixed in 0.0.0-202303200735 CWE-668

TI-2021-17976 CVE-2021-41137

Bypassing policy restrictions on regular users

MEDIUM 41

Minio is a Kubernetes native application for cloud storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01285 Published 2021-10-13 No fix listed CWE-285

TI-2026-29773 CVE-2026-41145 · GHSA-hv4r-mvr4-25vw

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

MEDIUM 40

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00349 Published 2026-04-22 No fix listed CWE-287

TI-2025-23973 CVE-2025-32963 · GHSA-7m6v-q233-q9j9

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

LOW 37

MinIO Operator STS is a native IAM Authentication for Kubernetes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0063 Published 2025-04-22 Fixed in 7.1.0 CWE-522

TI-2026-26499 CVE-2026-34204 · GHSA-3rh2-v3gr-35p9

MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

LOW 36

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00129 Published 2026-03-31 No fix listed CWE-287

TI-2025-38747 CVE-2025-62506 · GHSA-jjjj-jwhf-8rgr

MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

LOW 36

MinIO is a high-performance object storage system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00565 Published 2025-10-16 Fixed in 0.0.0-20251015170045-c1a49490c78e CWE-863

TI-2021-04461 CVE-2021-21362

Bypassing readOnly policy by creating a temporary 'mc share upload' URL

LOW 36

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01321 Published 2021-03-08 No fix listed CWE-285

Open these records in search →