MinIO has 15 CVEs on record between 2023 and 2026. 1 was published in the last 90 days. The busiest recent month was March 2026 with 3. The median CVSS is 8.1 (high), with 2 rated critical. 7% have been exploited in the wild, in line with the corpus average. Most affected products: github.com/minio/minio (14), MinIO (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 7% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —(1)
- Last 90 days
- 1 prev 1
Weakness classes
Products
- github.com/minio/minio 14
- MinIO 1
Worst active — by depth score
CVE-2023-28434High· 8.8Privilege Escalation on Linux/MacOS75CVE-2024-24747High· 8.8Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation67CVE-2025-62506High· 8.1MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS57CVE-2025-31489HighMinIO performs incomplete signature validation for unsigned-trailer uploads54CVE-2026-33419CriticalMinIO LDAP login brute-force via user enumeration and missing rate limit52
MinIO vulnerabilities
CVEs affecting MinIO, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-97731High· 7.1MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and nev…
CVE-2026-42600Medium· 4.9MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
CVE-2026-41145High· 8.2MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
CVE-2026-40344High· 8.2MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
CVE-2026-39414HighMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
CVE-2026-34204High· 7.1MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
CVE-2026-33419CriticalMinIO LDAP login brute-force via user enumeration and missing rate limit
MinIO LDAP login brute-force via user enumeration and missing rate limit
CVE-2026-33322CriticalMinIO has JWT Algorithm Confusion in OIDC Authentication
MinIO has JWT Algorithm Confusion in OIDC Authentication
CVE-2025-62506High· 8.1PoCMinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS
CVE-2025-31489HighPoCMinIO performs incomplete signature validation for unsigned-trailer uploads
MinIO performs incomplete signature validation for unsigned-trailer uploads
CVE-2025-27414MediumMinIO allows an SFTP authentication bypass due to improperly trusted SSH key
MinIO allows an SFTP authentication bypass due to improperly trusted SSH key
CVE-2024-36107Medium· 5.3MinIO information disclosure vulnerability
MinIO information disclosure vulnerability
CVE-2024-24747High· 8.8PoCMinio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
CVE-2023-28433High· 8.8Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation
CVE-2023-28434High· 8.8CISA KEVPoCPrivilege Escalation on Linux/MacOS
Privilege Escalation on Linux/MacOS