minio

6 results · Clear filters · Feed

• High 8.1
  CVE-2025-62506 Public exploit

  MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

  MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their i…

  minio minio github.com/minio/minio Go
  Oct 16, 2025
• High 8.8
  CVE-2024-24747 Public exploit EPSS 34%

  MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

  MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin`…

  minio minio github.com/minio/minio minio Alpine Go
  Jan 31, 2024
• High 8.8
  CVE-2023-28434 Exploited Public exploit

  MinIO is vulnerable to privilege escalation on Linux/MacOS

  Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…

  minio minio github.com/minio/minio Go
  Mar 22, 2023

  KEV Sep 19, 2023
• High 7.5
  CVE-2023-28432 Exploited Public exploit EPSS 84%

  Minio Information Disclosure in Cluster Deployment

  Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…

  minio minio
  Mar 22, 2023

  KEV Apr 21, 2023
• High 7.4
  CVE-2022-35919 Public exploit EPSS 52%

  Authenticated requests for server update admin API allows path traversal in minio

  MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path req…

  minio minio
  Aug 1, 2022
• High 8.8
  CVE-2021-43858 Public exploit EPSS 35%

  User privilege escalation in MinIO

  MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `REL…

  minio minio
  Dec 27, 2021