GHSA-XH8F-G2QW-GCM7 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-42600 vulnerabilities

Vulnerabilities for packages: minio...

GHSA-8RM2-7QQF-34QM vulnerabilities

Vulnerabilities for packages: metrics-server-fips, beats, datadog-agent-fips, minio-operator-fips, opentelemetry-collector-k8s, aws-otel-collector, node-problem-detector, trillian-fips, cloudzero-agent-fips, telegraf, aws-otel-collector-fips, elastic-agent-fips, minio-operator, grafana-fips, isti...

CVE-2026-42154 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, beats, datadog-agent-fips, minio-operator-fips, opentelemetry-collector-k8s, aws-otel-collector, node-problem-detector, trillian-fips, cloudzero-agent-fips, telegraf, aws-otel-collector-fips, elastic-agent-fips, minio-operator, grafana-fips, isti...

CVE-2026-42600 vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

GHSA-XH8F-G2QW-GCM7 vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

CLEANSTART-2026-SE34232 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-40179, CVE-2026-42499, CVE-2026-42501, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 7.1.1-r10, 7.1.1-r7, 7.1.1-r8, 7.1.1-r9

Multiple security vulnerabilities affect the minio-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Authentication Bypass

MinIO is vulnerable to Authentication Bypass. The vulnerability is due to missing signature verification for authTypeStreamingUnsignedTrailer requests in the Snowball auto-extract handler, which allows an attacker with knowledge of a valid access key to upload arbitrary objects without providing ...

Missing Authorization

github.com/minio/minio is vulnerable to IMissing Authorization. The vulnerability is due to insufficient validation of user-supplied X-Minio-Replication- headers in the extractMetadataFromMime function, which allows an authenticated attacker with s3:PutObject permissions to inject internal...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: karma, datadog-agent, prometheus-pushgateway, opentelemetry-collector, node-problem-detector, certificate-transparency, metrics-server, k8sgpt, fluent-bit-plugin-loki, opentelemetry-operator, mc, telegraf, loki, jaeger, istio, tempo, cloud-sql-proxy,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, opentelemetry-collector-contrib-fips, beats, datadog-agent-fips, minio-operator-fips, aws-otel-collector, node-problem-detector, trillian-fips, cloudzero-agent-fips, telegraf, aws-otel-collector-fips, elastic-agent-fips, minio-operator, istio,...

BIT-MINIO-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

MinIO is a high-performance object storage system. From 2022.07.24 to before 2026.04.14, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

CVE-2026-31215

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...

EUVD-2026-29500

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

EUVD-2026-29499

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

CVE-2026-31215

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...

CVE-2026-31215

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...

CVE-2026-31215

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...