MinIO

Products

Exploited and recent CVEs

• CVE-2023-28434 High 8.8 Exploited MinIO is vulnerable to privilege escalation on Linux/MacOS 7.9%
• CVE-2023-28432 High 7.5 Exploited Minio Information Disclosure in Cluster Deployment 84.0%
• CVE-2026-97731 High 7.1 MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go i 0.2%
• CVE-2026-42600 Medium 6.9 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint 8.7%
• CVE-2026-41145 High 8.8 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads 0.3%
• CVE-2026-40344 High 8.8 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads 0.4%
• CVE-2026-39414 High 7.1 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing 0.5%
• CVE-2026-34204 High 7.1 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers 0.1%
• CVE-2026-33419 Critical 9.1 MinIO: LDAP login brute-force via user enumeration and missing rate limit 0.5%
• CVE-2026-33322 Critical 9.2 MinIO: JWT Algorithm Confusion in OIDC Authentication 0.4%
• CVE-2025-62506 High 8.1 MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS 0.6%
• CVE-2025-59952 High 8.7 minio-java Client XML Tag is Vulnerable to Value Substitution 0.5%
• CVE-2025-32963 Medium 6.9 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS 0.6%
• CVE-2025-31489 High 8.7 MinIO performs incomplete signature validation for unsigned-trailer uploads 2.5%
• CVE-2025-27414 Medium 4.6 MinIO SFTP authentication bypass due to improperly trusted SSH key 0.6%
• CVE-2024-55949 Critical 9.3 Privilege escalation in IAM import API in MinIO 0.6%
• CVE-2024-36107 Medium 5.3 Information disclosure in minio 0.6%
• CVE-2024-24747 High 8.8 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation 34.1%
• CVE-2023-33955 Medium 4.3 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited 0.6%
• CVE-2023-28433 High 8.8 Minio Privilege Escalation on Windows via Path separator manipulation 1.0%
• CVE-2023-27589 Medium 6.5 Minio vulnerable to denial of access by an admin privileged user for root credential 0.9%
• CVE-2023-25812 Medium 6.5 Allowed DELETE on resources on object locked buckets under Governance mode in Minio 1.0%
• CVE-2022-35919 High 7.4 Authenticated requests for server update admin API allows path traversal in minio 52.1%
• CVE-2022-31028 High 7.5 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO 3.0%
• CVE-2022-24842 High 8.8 Improper Privilege Management in MinIO 2.1%
• CVE-2021-43858 High 8.8 User privilege escalation in MinIO 35.5%
• CVE-2021-41266 High 8.6 Authentication bypass issue in the Operator Console 48.1%
• CVE-2021-41137 High 8.8 Bypassing policy restrictions on regular users 1.3%
• CVE-2021-21390 Medium 6.5 MITM modification of request bodies in MinIO 0.9%
• CVE-2021-21362 High 7.7 Bypassing readOnly policy by creating a temporary 'mc share upload' URL 1.3%