GHSA-XH8F-G2QW-GCM7 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID...

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID...

GHSA-JV87-32HW-HH99 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-34204 vulnerabilities

Vulnerabilities for packages: minio...

GHSA-3RH2-V3GR-35P9 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-33419 vulnerabilities

Vulnerabilities for packages: minio...

GHSA-JV87-32HW-HH99 vulnerabilities

Vulnerabilities for packages: minio...

GHSA-3RH2-V3GR-35P9 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-34204 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-33419 vulnerabilities

Vulnerabilities for packages: minio...

PT-2026-37272

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2022-07-24T01-54-52Z through RELEASE.2025-09-07T16-13-09Z Description A path traversal issue in the ReadMultiple internode storage-REST endpoint allows an attacker with the cluster root JWT to read files outside the...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: dex, spqr, telegraf, opentofu, ratify, kyverno-notation-aws, minio, seaweedfs, bento, grafana, k6, nuclei, juicefs, zot, rancher-agent, trufflehog, rclone, cert-manager, rancher-webhook, frp, yunikorn-k8shim, kyverno, cert-manager-cmctl, xeol, openbao, teleport,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: dex, spqr, telegraf, opentofu, ratify, kyverno-notation-aws, minio, seaweedfs, bento, grafana, k6, nuclei, juicefs, zot, rancher-agent, trufflehog, rclone, cert-manager, rancher-webhook, frp, yunikorn-k8shim, kyverno, cert-manager-cmctl, xeol, openbao, teleport,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: dex, harbor-fips, neuvector, syncthing, external-secrets-operator, neuvector-fips, seaweedfs-rocksdb, rancher-agent, cert-manager-cmctl, cert-manager-google-cas-issuer-fips, minio-fips, elastic-agent, cert-manager-csi-driver-fips, trufflehog-fips,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: dex, harbor-fips, neuvector, syncthing, external-secrets-operator, neuvector-fips, seaweedfs-rocksdb, rancher-agent, cert-manager-cmctl, cert-manager-google-cas-issuer-fips, minio-fips, elastic-agent, cert-manager-csi-driver-fips, trufflehog-fips,...

BIT-MINIO-2026-41145 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

MinIO is a high-performance object storage system. Starting in 2023.05.18 and prior to 2026.04.11, an authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing t...

BIT-MINIO-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

MinIO is a high-performance object storage system. Starting in 2023.05.18 and prior to 2026.04.11, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler PutObjectExtractHandler allows any user who knows a valid access key to write arbitrary objects to any bucket without...

CVE-2026-40344

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler PutObjectExtractHandler allows any user who knows a valid access key to write...

CVE-2026-41145

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to write arbitrary...

EUVD-2026-24581

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to write arbitrary...