CVE-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler PutObjectExtractHandler allows any user who knows a valid access key to write...

MinIO 授权问题漏洞

MinIO is an open-source object storage server developed by the American company MinIO. This product supports the creation of infrastructures for machine learning, analysis, and application data workloads. There is an authorization vulnerability in MinIO, which stems from a authentication bypass i...

CLEANSTART-2026-QO20135 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Multiple security vulnerabilities affect the minio-operator-fips package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. See references for individual...

CLEANSTART-2026-YG63570 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the minio-operator-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

GHSA-HV4R-MVR4-25VW MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

Impact What kind of vulnerability is it? Who is impacted? An authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid...

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

Impact What kind of vulnerability is it? Who is impacted? An authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, trillian, minio, datadog-agent, grafana-pyroscope, cloud-sql-proxy, telegraf, splunk-otel-collector, istio, tempo, minio-object-browser, loki, aws-otel-collector, certificate-transparency, jaeger, karma, mc, minio-operator, keda, mcp-grafana...

CVE-2026-40179 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, trillian, minio, datadog-agent, grafana-pyroscope, cloud-sql-proxy, telegraf, splunk-otel-collector, istio, tempo, minio-object-browser, loki, aws-otel-collector, certificate-transparency, jaeger, karma, mc, minio-operator, keda, mcp-grafana...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: grafana-fips, tempo-fips, mcp-grafana, cloud-sql-proxy-fips, karma-fips, cloud-sql-proxy, prometheus, keda, nrdot-collector, trillian-fips, minio-object-browser-fips, cloudzero-agent, wavefront-collector-for-kubernetes, beats-fips, datadog-agent, agentbeat, istio,...

CVE-2026-40179 vulnerabilities

Vulnerabilities for packages: grafana-fips, tempo-fips, mcp-grafana, cloud-sql-proxy-fips, karma-fips, cloud-sql-proxy, prometheus, keda, nrdot-collector, trillian-fips, minio-object-browser-fips, cloudzero-agent, wavefront-collector-for-kubernetes, beats-fips, datadog-agent, agentbeat, istio,...

GHSA-9C4Q-HQ6P-C237 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

Impact Two authentication bypass vulnerabilities in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allow any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is...

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

Impact Two authentication bypass vulnerabilities in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allow any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is...

PT-2026-34234

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z Description An authentication bypass exists in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path. An attacker possessing a valid access key can write arbitrary...

BIT-MINIO-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function...

PT-2026-32435

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit function...

ANT-2026-BRQZSDGZ · minio · path-traversal

path-traversal medium GHSA-xh8f-g2qw-gcm7 Severity Claude critical · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-BRQZSDGZ: minio: path-traversa...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, kargo, vale, jitsucom-bulker, docker-machine-driver-linode, scorecard, terraform-provider-kubernetes, haproxy-ingress, rabbitmq-messaging-topology-operator, spire-server, hubble, kube-bench, zot, sriov-network-device-plugin,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, kargo, vale, jitsucom-bulker, docker-machine-driver-linode, scorecard, terraform-provider-kubernetes, haproxy-ingress, rabbitmq-messaging-topology-operator, spire-server, hubble, kube-bench, zot, sriov-network-device-plugin,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, kargo, vale, jitsucom-bulker, docker-machine-driver-linode, scorecard, terraform-provider-kubernetes, haproxy-ingress, rabbitmq-messaging-topology-operator, spire-server, hubble, kube-bench, zot, sriov-network-device-plugin,...

PT-2026-34231

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z Description An authentication bypass exists in the Snowball auto-extract handler PutObjectExtractHandler. This issue allows a user with a valid access key to writ...