Vulnerabilities

Filters

1 selected

33 records

Sort

Vendor: MinIO Clear all filters

TI-2026-64270 CVE-2026-97731 · GHSA-r7wh-x6rf-8g63

Improper signature verification in MinIO

LOW 30

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00167 Published 2026-09-25 No fix listed CWE-347

TI-2026-30880 CVE-2026-42600 · GHSA-xh8f-g2qw-gcm7

MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.08695 Published 2026-05-11 Fixed in 0.0.0-20260414213245 CWE-22

TI-2026-29773 CVE-2026-41145 · GHSA-hv4r-mvr4-25vw

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

MEDIUM 40

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00349 Published 2026-04-22 No fix listed CWE-287

TI-2026-29119 CVE-2026-40344 · GHSA-9c4q-hq6p-c237

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

MEDIUM 44

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00418 Published 2026-04-22 No fix listed CWE-287

TI-2026-28396 CVE-2026-39414 · GHSA-h749-fxx7-pwpg

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

LOW 32

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-04-08 No fix listed CWE-770

TI-2026-26499 CVE-2026-34204 · GHSA-3rh2-v3gr-35p9

MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

LOW 36

MinIO is a high-performance object storage system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00129 Published 2026-03-31 No fix listed CWE-287

TI-2026-25816 CVE-2026-33419 · GHSA-jv87-32hw-hh99

MinIO: LDAP login brute-force via user enumeration and missing rate limit

MEDIUM 46

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00456 Published 2026-03-24 No fix listed CWE-204

TI-2026-25733 CVE-2026-33322 · GHSA-5cx5-wh4m-82fh

MinIO: JWT Algorithm Confusion in OIDC Authentication

MEDIUM 42

MinIO is a high-performance object storage system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00425 Published 2026-03-24 No fix listed CWE-287

TI-2025-38747 CVE-2025-62506 · GHSA-jjjj-jwhf-8rgr

MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

LOW 36

MinIO is a high-performance object storage system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00565 Published 2025-10-16 Fixed in 0.0.0-20251015170045-c1a49490c78e CWE-863

TI-2025-37340 CVE-2025-59952 · GHSA-h7rh-xfpj-hpcm

minio-java Client XML Tag is Vulnerable to Value Substitution

MEDIUM 44

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00491 Published 2025-09-29 Partial fix · 8.6.0 CWE-20

TI-2025-23973 CVE-2025-32963 · GHSA-7m6v-q233-q9j9

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

LOW 37

MinIO Operator STS is a native IAM Authentication for Kubernetes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0063 Published 2025-04-22 Fixed in 7.1.0 CWE-522

TI-2025-22670 CVE-2025-31489 · GHSA-wg47-6jq2-q2hh

MinIO performs incomplete signature validation for unsigned-trailer uploads

MEDIUM 48

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02519 Published 2025-04-03 Fixed in 0.0.0-20250403145552-8c70975283f9 CWE-347

TI-2025-20249 CVE-2025-27414 · GHSA-wc79-7x8x-2p58

MinIO SFTP authentication bypass due to improperly trusted SSH key

LOW 22

MinIO is a high performance object storage.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00586 Published 2025-02-28 Fixed in 0.0.0-20250227184332-4c71f1b4ec0f CWE-287

TI-2024-36990 CVE-2024-55949 · GHSA-cwq8-g58r-32hg

Privilege escalation in IAM import API in MinIO

MEDIUM 43

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00608 Published 2024-12-16 Fixed in 0.0.0-20241213221912-68b004a48f41 CWE-269

TI-2024-23937 CVE-2024-36107 · GHSA-95fr-cm4m-q5p9

Information disclosure in minio

LOW 31

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00629 Published 2024-05-28 Partial fix · 0.0.0-20240527191746-e0fe7cc39172 CWE-200

TI-2024-16264 CVE-2024-24747 · GHSA-xx8w-mq23-29g4

MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

HIGH 73

MinIO is a High Performance Object Storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.34086 Published 2024-01-31 Fixed in 0.0.0-20240131185645-0ae4915a9391 CWE-269

TI-2023-16823 CVE-2023-33955 · GHSA-jv3f-7m33-qp65

Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

LOW 25

Minio Console is the UI for MinIO Object Storage.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00648 Published 2023-05-30 Fixed in 0.28.0 CWE-200

TI-2023-12978 CVE-2023-28434 · GHSA-2pxw-r47w-4p8c

MinIO is vulnerable to privilege escalation on Linux/MacOS

CRITICAL 97KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07917 Published 2023-03-22 Fixed in 0.0.0-202303200415 CWE-269

TI-2023-12977 CVE-2023-28433 · GHSA-w23q-4hw3-2pp6

Minio Privilege Escalation on Windows via Path separator manipulation

MEDIUM 42

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00981 Published 2023-03-22 Fixed in 0.0.0-202303200735 CWE-668

TI-2023-12976 CVE-2023-28432

Minio Information Disclosure in Cluster Deployment

CRITICAL 90KEV

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83957 Published 2023-03-22 No fix listed CWE-200

TI-2023-12299 CVE-2023-27589

Minio vulnerable to denial of access by an admin privileged user for root credential

LOW 31

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00898 Published 2023-03-14 No fix listed CWE-269

TI-2023-11082 CVE-2023-25812

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

HIGH 77

Minio is a Multi-Cloud Object Storage framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00955 Published 2023-02-21 No fix listed CWE-281

TI-2022-16346 CVE-2022-35919

Authenticated requests for server update admin API allows path traversal in minio

HIGH 66

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.52144 Published 2022-08-01 No fix listed CWE-22

TI-2022-13073 CVE-2022-31028

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

HIGH 72

MinIO is a multi-cloud object storage solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03043 Published 2022-06-03 No fix listed CWE-400

TI-2022-08654 CVE-2022-24842

Improper Privilege Management in MinIO

HIGH 73

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02117 Published 2022-04-12 No fix listed CWE-269