Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
Priority LOW 37CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.
Summary
MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0063 50th percentileScored 2026-11-07
Fix Fixed operator (minio): 7.1.0github.com/minio/operator (Go): 7.1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MinIO | operator | before 7.1.0 | 7.1.0 | Patch available | CNA |
| — | github.com/minio/operator (Go) | before 7.1.0 | 7.1.0 | Patch available | GHSA-7m6v-q233-q9j9 |
- operator VendorMinIO Affected before 7.1.0 Fixed in 7.1.0 Patch available CNA
- github.com/minio/operator (Go) Vendor— Affected before 7.1.0 Fixed in 7.1.0 Patch available GHSA-7m6v-q233-q9j9
Remediation
- Fix · CNA operator (minio) Fixed in 7.1.0
- Fix · GHSA-7m6v-q233-q9j9 github.com/minio/operator (Go) Fixed in 7.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32963
- 2026-10-03 Alias added: GHSA-7m6v-q233-q9j9
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
More MinIO vulnerabilities
- TI-2023-12978 MinIO is vulnerable to privilege escalation on Linux/MacOS KEVCVSS 3.1HIGH 8.8
- TI-2023-12976 Minio Information Disclosure in Cluster Deployment KEVCVSS 3.1HIGH 7.5
- TI-2023-11082 Allowed DELETE on resources on object locked buckets under Governance mode in Minio CVSS 3.1HIGH 8.8
- TI-2024-16264 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVSS 3.1HIGH 8.8
- TI-2022-08654 Improper Privilege Management in MinIO CVSS 3.1HIGH 8.8
- TI-2021-18098 Authentication bypass issue in the Operator Console CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-32963 · CVE Program
- CVE-2025-32963 · NVD
- FIRST EPSS
- GHSA-7m6v-q233-q9j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences