Read the docs
TI-2021-18098 Aliases CVE-2021-41266GHSA-4999-659w-mq36

Authentication bypass issue in the Operator Console

Priority HIGH 73CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.

Why it matters now

EPSS 0.48134 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed console (minio): 0.12.3github.com/minio/console (Go): 0.12.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MinIOconsolebefore 0.12.30.12.3Patch availableCNA
—github.com/minio/console (Go)before 0.12.30.12.3Patch availableGHSA-4999-659w-mq36
  • console VendorMinIO Affected before 0.12.3 Fixed in 0.12.3 Patch available CNA
  • github.com/minio/console (Go) Vendor— Affected before 0.12.3 Fixed in 0.12.3 Patch available GHSA-4999-659w-mq36

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:min:minio_console:*:*:*:*:*:*:*:*before 0.12.3VulnerableMin
  • cpe:2.3:a:min:minio_console:*:*:*:*:*:*:*:* Versions before 0.12.3 Vulnerable ·Min

Remediation

  • Fix · CNA console (minio) Fixed in 0.12.3
  • Fix · GHSA-4999-659w-mq36 github.com/minio/console (Go) Fixed in 0.12.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41266
  2. 2026-10-03 Alias added: GHSA-4999-659w-mq36

References

Exploit 1

Advisory 2

Other 1

  • TI-2023-12978 MinIO is vulnerable to privilege escalation on Linux/MacOS KEVCVSS 3.1HIGH 8.8
  • TI-2023-12976 Minio Information Disclosure in Cluster Deployment KEVCVSS 3.1HIGH 7.5
  • TI-2023-11082 Allowed DELETE on resources on object locked buckets under Governance mode in Minio CVSS 3.1HIGH 8.8
  • TI-2024-16264 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVSS 3.1HIGH 8.8
  • TI-2022-08654 Improper Privilege Management in MinIO CVSS 3.1HIGH 8.8
  • TI-2022-13073 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO CVSS 3.1HIGH 7.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences