Read the docs
TI-2026-85692 Aliases CVE-2026-122267

MinIO Signature V4 verification accepts unsigned x-amz-* headers

Priority LOW 37CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Chainguard MinIO through RELEASE.2026-09-21T00-15-41Z does not verify all x-amz-* headers in Signature V4 requests, which is a case of improper verification of a cryptographic signature (CWE-347). A remote attacker with no privileges and no user interaction can escalate a presigned PUT URL into a read of objects in another bucket.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.

Why it matters now

EPSS 0.00199 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
chainguard-devMinIOup to RELEASE.2026-09-21T00-15-41Z—No fix listedCNA
  • MinIO Vendorchainguard-dev Affected up to RELEASE.2026-09-21T00-15-41Z Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Chainguard MinIO.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-122267
  2. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2024-23955 apko Exposure of HTTP basic auth credentials in log output CVSS 3.1HIGH 7.5
  • TI-2026-22680 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVSS 3.1HIGH 8.2
  • TI-2026-83911 kaniko sends Azure access tokens to lookalike ACR registry hosts CVSS 3.1CRITICAL 9.3
  • TI-2026-30854 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVSS 3.1HIGH 7.5
  • TI-2026-20302 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams CVSS 3.1HIGH 7.5
  • TI-2026-20284 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences