CVE-2025-31489High▾ MidnightPoC availableMinIO performs incomplete signature validation for unsigned-trailer uploads
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
2.4%
Nuclei ×1
Last analysed / modified upstream
2.4% → 2.5%
This is a high priority vulnerability and users must upgrade ASAP.
The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket,
Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary.
However with relevant information in place, uploading random objects to buckets is trivial and easy via curl
Yes https://github.com/minio/minio/pull/21103
Reject requests with x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER for now at LB layer, ask application users to use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER
github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9Upgrade to a patched release:
github.com/minio/minio 0.0.0-20250403145552-8c70975283f9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-24747High· 8.8Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
CVE-2025-62506High· 8.1MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
CVE-2023-28434High· 8.8Privilege Escalation on Linux/MacOS
CVE-2026-42600Medium· 4.9MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
CVE-2025-27414MediumMinIO allows an SFTP authentication bypass due to improperly trusted SSH key
CVE-2023-28433High· 8.8Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation