Advisoriesby Ibis
MinIO security advisories
15 advisories · 6 critical or high in 12 months · latest May 5
15 advisories
MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointCVE-2026-42600fixed in 0.0.0-20260414213245MinIO: authentication bypassCVE-2026-41145no fix yetMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer UploadsCVE-2026-40344no fix yetMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingCVE-2026-39414no fix yetMinIO is Vulnerable to SSE Metadata Injection via Replication HeadersCVE-2026-34204no fix yetMinIO LDAP login brute-force via user enumeration and missing rate limitCVE-2026-33419no fix yetMinIO has JWT Algorithm Confusion in OIDC AuthenticationCVE-2026-33322no fix yetMinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STSCVE-2025-62506fixed in 0.0.0-20251015170045-c1a49490c78eMinIO performs incomplete signature validation for unsigned-trailer uploadsCVE-2025-31489fixed in 0.0.0-20250403145552-8c70975283f9MinIO allows an SFTP authentication bypass due to improperly trusted SSH keyCVE-2025-27414fixed in 0.0.0-20250227184332-4c71f1b4ec0fMinIO vulnerable to privilege escalation in IAM import APICVE-2024-55949fixed in 0.0.0-20241213221912-68b004a48f41MinIO information disclosure vulnerabilityCVE-2024-36107fixed in 0.0.0-20240527191746-e0fe7cc39172Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationCVE-2024-24747fixed in 0.0.0-20240131185645-0ae4915a9391Minio vulnerable to Privilege Escalation on Windows via Path separator manipulationCVE-2023-28433fixed in 0.0.0-202303200735Privilege Escalation on Linux/MacOSCVE-2023-28434fixed in 0.0.0-202303200415About MinIO
S3-compatible object storage for AI data.
Packages watched: github.com/minio/minio (Go).