Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MinIO ausnutzen, um die Authentifizierung zu umgehen und Daten zu manipulieren.
Product
MinIO ist ein S3-kompatibler Objektspeicher, der für groß angelegte KI/ML-, Data Lake- und Datenbank-Workloads entwickelt wurde. Er läuft "on-premise" und in jeder Cloud.
Vulnerabilities 2
-
High 8.8
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user …
-
High 8.8
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path allows any user who knows a…
Revision history
-
#2
CVE's ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-9c4q-hq6p-c237 vom 2026-04-13
https://github.com/advisories/GHSA-9c4q-hq6p-c237
-
GitHub Security Advisory GHSA-hv4r-mvr4-25vw vom 2026-04-13
https://github.com/minio/minio/security/advisories/GHSA-hv4r-mvr4-25vw