github.com/minio/minio vulnerabilities
CVEs whose affected-version data names the github.com/minio/minio package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
15 CVEsRSS
CVE-2026-42600Medium· 4.9MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
CVE-2026-41145High· 8.2MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
CVE-2026-40344High· 8.2MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
CVE-2026-39414HighMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
CVE-2026-34204High· 7.1MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
CVE-2026-33419CriticalMinIO LDAP login brute-force via user enumeration and missing rate limit
MinIO LDAP login brute-force via user enumeration and missing rate limit
CVE-2026-33322CriticalMinIO has JWT Algorithm Confusion in OIDC Authentication
MinIO has JWT Algorithm Confusion in OIDC Authentication
CVE-2025-62506High· 8.1PoCMinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
CVE-2025-31489HighPoCMinIO performs incomplete signature validation for unsigned-trailer uploads
MinIO performs incomplete signature validation for unsigned-trailer uploads
CVE-2025-27414MediumMinIO allows an SFTP authentication bypass due to improperly trusted SSH key
MinIO allows an SFTP authentication bypass due to improperly trusted SSH key
CVE-2024-55949High· 8.1minio: Privilege escalation in IAM import API in MinIO (CVE-2024-55949)
A flaw was found in MinIO. Due to insufficient permissions checking in the IAM import API, a user may be able to change their policy mapping to escalate their privileges via a specially crafted configuration file.
CVE-2024-36107Medium· 5.3MinIO information disclosure vulnerability
MinIO information disclosure vulnerability
CVE-2024-24747High· 8.8PoCMinio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
CVE-2023-28433High· 8.8Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation
CVE-2023-28434High· 8.8CISA KEVPoCPrivilege Escalation on Linux/MacOS
Privilege Escalation on Linux/MacOS