Skip to content
OpenAdvisories

Vendor

minio

32 known vulnerabilities.

Products

minio 28 console 2 minio-java 1 operator 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-33419

    MinIO: LDAP login brute-force via user enumeration and missing rate limit

    MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distin…

    minio minio minio minio-iamguarded-2025-compat Wolfi Go
  • Critical 9.2
    CVE-2026-33322

    MinIO: JWT Algorithm Confusion in OIDC Authentication

    MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to…

    minio minio minio github.com/minio/minio Wolfi Go
  • Critical 9.3
    CVE-2024-55949

    Privilege escalation in IAM import API in MinIO

    MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has …

    minio minio github.com/minio/minio Go
  • Critical 9.3
    CVE-2020-11012

    Authentication bypass MinIO Admin API

    MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without know…

    minio minio minio Alpine