Skip to content
OpenAdvisories

Vendor

minio

32 known vulnerabilities.

Products

minio 28 console 2 minio-java 1 operator 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-42600

    MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

    MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to…

    minio minio github.com/minio/minio Go
  • Medium 6.9
    CVE-2025-32963

    Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

    MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal syste…

    minio operator github.com/minio/operator Go
  • Medium 4.6
    CVE-2025-27414

    MinIO SFTP authentication bypass due to improperly trusted SSH key

    MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data…

    minio minio github.com/minio/minio Go
  • Medium 5.3
    CVE-2024-36107

    Information disclosure in minio

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an o…

    minio minio github.com/minio/minio Go
  • Medium 4.3
    CVE-2023-33955

    Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

    Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.

    minio console github.com/minio/console Go
  • Medium 6.5
    CVE-2023-27589

    Minio vulnerable to denial of access by an admin privileged user for root credential

    Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this…

    minio minio
  • Medium 6.5
    CVE-2023-25812

    Allowed DELETE on resources on object locked buckets under Governance mode in Minio

    Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Gove…

    minio minio
  • Medium 6.5
    CVE-2021-21390

    MITM modification of request bodies in MinIO

    MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies tha…

    minio minio