MinIO

Records33All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high21CVSS 7.0–8.9

Exploited now

MinIO records in CISA KEV

TI-2023-12978 MinIO Security Feature Bypass Vulnerability CRITICAL 97KEV 2023-09-19 TI-2023-12976 MinIO Information Disclosure Vulnerability CRITICAL 90KEV 2023-04-21

Components

Products in the NVD configurations · select one to filter the records

Minio 23 records CRITICAL Console 1 record LOW

Records

23 records in Minio · all components

TI-2023-12978 CVE-2023-28434 · GHSA-2pxw-r47w-4p8c

MinIO is vulnerable to privilege escalation on Linux/MacOS

CRITICAL 97KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07917 Published 2023-03-22 Fixed in 0.0.0-202303200415 CWE-269

TI-2023-12976 CVE-2023-28432

Minio Information Disclosure in Cluster Deployment

CRITICAL 90KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83957 Published 2023-03-22 No fix listed CWE-200

TI-2023-11082 CVE-2023-25812

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

HIGH 77

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00955 Published 2023-02-21 No fix listed CWE-281

TI-2024-16264 CVE-2024-24747 · GHSA-xx8w-mq23-29g4

MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

HIGH 73

MinIO is a High Performance Object Storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.34086 Published 2024-01-31 Fixed in 0.0.0-20240131185645-0ae4915a9391 CWE-269

TI-2022-08654 CVE-2022-24842

Improper Privilege Management in MinIO

HIGH 73

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02117 Published 2022-04-12 No fix listed CWE-269

TI-2022-13073 CVE-2022-31028

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

HIGH 72

MinIO is a multi-cloud object storage solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03043 Published 2022-06-03 No fix listed CWE-400

TI-2022-16346 CVE-2022-35919

Authenticated requests for server update admin API allows path traversal in minio

HIGH 66

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.52144 Published 2022-08-01 No fix listed CWE-22

TI-2021-19664 CVE-2021-43858

User privilege escalation in MinIO

MEDIUM 64

MinIO is a Kubernetes native application for cloud storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.35462 Published 2021-12-27 Partial fix CWE-269

TI-2021-04387 CVE-2021-21287

Server-Side Request Forgery in MinIO Browser API

MEDIUM 54

MinIO is a High Performance Object Storage released under Apache License v2.0.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.23896 Published 2021-02-01 No fix listed CWE-918

TI-2026-25816 CVE-2026-33419 · GHSA-jv87-32hw-hh99

MinIO: LDAP login brute-force via user enumeration and missing rate limit

MEDIUM 46

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00456 Published 2026-03-24 No fix listed CWE-204

TI-2026-29119 CVE-2026-40344 · GHSA-9c4q-hq6p-c237

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

MEDIUM 44

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00418 Published 2026-04-22 No fix listed CWE-287

TI-2020-08886 CVE-2020-11012 · GHSA-xv4r-vccv-mg4w

Authentication bypass MinIO Admin API

MEDIUM 44

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.01872 Published 2020-04-23 No fix listed CWE-305

TI-2026-30880 CVE-2026-42600 · GHSA-xh8f-g2qw-gcm7

MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.08695 Published 2026-05-11 Fixed in 0.0.0-20260414213245 CWE-22

TI-2026-25733 CVE-2026-33322 · GHSA-5cx5-wh4m-82fh

MinIO: JWT Algorithm Confusion in OIDC Authentication

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00425 Published 2026-03-24 No fix listed CWE-287

TI-2023-12977 CVE-2023-28433 · GHSA-w23q-4hw3-2pp6

Minio Privilege Escalation on Windows via Path separator manipulation

MEDIUM 42

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00981 Published 2023-03-22 Fixed in 0.0.0-202303200735 CWE-668

TI-2021-17976 CVE-2021-41137

Bypassing policy restrictions on regular users

MEDIUM 41

Minio is a Kubernetes native application for cloud storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01285 Published 2021-10-13 No fix listed CWE-285

TI-2026-29773 CVE-2026-41145 · GHSA-hv4r-mvr4-25vw

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

MEDIUM 40

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00349 Published 2026-04-22 No fix listed CWE-287

TI-2026-26499 CVE-2026-34204 · GHSA-3rh2-v3gr-35p9

MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

LOW 36

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00129 Published 2026-03-31 No fix listed CWE-287

TI-2021-04461 CVE-2021-21362

Bypassing readOnly policy by creating a temporary 'mc share upload' URL

LOW 36

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01321 Published 2021-03-08 No fix listed CWE-285

TI-2018-15936 CVE-2018-1000538

Minio Inc.

LOW 36

Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Servic…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01485 Published 2018-06-26 No fix listed CWE-774

TI-2026-28396 CVE-2026-39414 · GHSA-h749-fxx7-pwpg

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

LOW 32

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-04-08 No fix listed CWE-770

TI-2023-12299 CVE-2023-27589

Minio vulnerable to denial of access by an admin privileged user for root credential

LOW 31

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00898 Published 2023-03-14 No fix listed CWE-269

TI-2021-04489 CVE-2021-21390

MITM modification of request bodies in MinIO

LOW 30

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00851 Published 2021-03-19 No fix listed CWE-924

Open these records in search →