Description
MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| minio | minio | >= RELEASE.2022-11-08T05-27-07Z, < RELEASE.2026-03-17T21-25-16Z | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 | SUSE-SU-2026:1135-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | minio | 0.20260604.005411-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/minio/minio | <= 0.0.0-20260212201848-7aac2a2c5b7c | — | GHSA-5cx5-wh4m-82fh |
| Go | github.com/minio/minio | all versions | — | GO-2026-4779 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:1135-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 31, 2026