GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: trillian-fips, certificate-transparency, trillian, elastic-agent, keda-fips, splunk-otel-collector-fips, telegraf, mcp-grafana-fips, certificate-transparency-fips, mcp-grafana, nrdot-collector-fips, splunk-otel-collector, minio-operator, grafana, istio-fips,...

CVE-2026-40179 vulnerabilities

Vulnerabilities for packages: trillian-fips, certificate-transparency, trillian, elastic-agent, keda-fips, splunk-otel-collector-fips, telegraf, mcp-grafana-fips, certificate-transparency-fips, mcp-grafana, nrdot-collector-fips, splunk-otel-collector, minio-operator, grafana, istio-fips,...

GHSA-9C4Q-HQ6P-C237 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

Impact Two authentication bypass vulnerabilities in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allow any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is...

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

Impact Two authentication bypass vulnerabilities in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allow any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is...

PT-2026-34234

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z Description An authentication bypass exists in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path. An attacker possessing a valid access key can write arbitrary...

BIT-MINIO-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function...

PT-2026-32435

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function...

ANT-2026-BRQZSDGZ · minio · path-traversal

path-traversal medium GHSA-xh8f-g2qw-gcm7 Severity Claude critical · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-BRQZSDGZ: minio: path-traversa...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kyverno, argo-workflows, nri-rabbitmq, lazygit, sbomqs, istio, k3s, kuberlr, mc, kube-logging-operator-custom-runner, knative-eventing, delve, snyk-cli, oras, nodetaint, gitleaks, consul-k8s, step-issuer, azure-workload-identity-webhook, amass, aws-flb-firehose, croc...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kyverno, argo-workflows, nri-rabbitmq, lazygit, sbomqs, istio, k3s, kuberlr, mc, kube-logging-operator-custom-runner, knative-eventing, delve, snyk-cli, oras, nodetaint, gitleaks, consul-k8s, step-issuer, azure-workload-identity-webhook, amass, aws-flb-firehose, croc...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kyverno, argo-workflows, nri-rabbitmq, lazygit, sbomqs, istio, k3s, kuberlr, mc, kube-logging-operator-custom-runner, knative-eventing, delve, snyk-cli, oras, nodetaint, gitleaks, consul-k8s, step-issuer, azure-workload-identity-webhook, amass, aws-flb-firehose, croc...

PT-2026-34231

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z Description An authentication bypass exists in the Snowball auto-extract handler PutObjectExtractHandler. This issue allows a user with a valid access key to writ...

GHSA-H749-FXX7-PWPG MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

Impact What kind of vulnerability is it? Who is impacted? MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function calls bufio.Reader.ReadBytes'\n' with no size limit, buffering the...

EUVD-2026-20602

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing...

CLEANSTART-2026-SQ18258 url

Multiple security vulnerabilities affect the minio-operator-fips package. url. See references for individual vulnerability details...

CLEANSTART-2026-UF78567 net/url package does not set a limit on the number of query parameters in a query

Multiple security vulnerabilities affect the minio-operator-fips package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...

CLEANSTART-2026-UQ00642 Docker CLI for Windows searches for plugin binaries in C:\\ProgramData\\Docker\\cli-plugins, a directory that does not exist by default

Multiple security vulnerabilities affect the minio-operator-fips package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. See references for individual vulnerability details...

CLEANSTART-2026-ST75560 During the TLS 1

Multiple security vulnerabilities affect the minio-operator-fips package. During the TLS 1. See references for individual vulnerability details...

CLEANSTART-2026-OT38160 url

Multiple security vulnerabilities affect the minio-operator-fips package. url. See references for individual vulnerability details...

CVE-2026-39414

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function...