minio/minio Security Advisories | GitStock

medium2026-05-05

CVE-2026-42600-MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

GHSA-xh8f-g2qw-gcm7

high2026-04-14

CVE-2026-41145-MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

GHSA-hv4r-mvr4-25vw

high2026-04-14

CVE-2026-40344-MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

GHSA-9c4q-hq6p-c237

high2026-04-09

CVE-2026-39414-MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

GHSA-h749-fxx7-pwpg

high2026-03-27

CVE-2026-34204-MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

GHSA-3rh2-v3gr-35p9

critical2026-03-20

CVE-2026-33419-MinIO LDAP login brute-force via user enumeration and missing rate limit

GHSA-jv87-32hw-hh99

critical2026-03-19

CVE-2026-33322-MinIO has JWT Algorithm Confusion in OIDC Authentication

GHSA-5cx5-wh4m-82fh

high2025-10-16

CVE-2025-62506-MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS

GHSA-jjjj-jwhf-8rgr

high2025-04-04

CVE-2025-31489-MinIO performs incomplete signature validation for unsigned-trailer uploads

GHSA-wg47-6jq2-q2hh

medium2025-03-03

CVE-2025-27414-MinIO allows an SFTP authentication bypass due to improperly trusted SSH key

GHSA-wc79-7x8x-2p58

high2024-12-16

CVE-2024-55949-MinIO vulnerable to privilege escalation in IAM import API

GHSA-cwq8-g58r-32hg

medium2024-05-29

CVE-2024-36107-MinIO information disclosure vulnerability

GHSA-95fr-cm4m-q5p9

high2024-02-01

CVE-2024-24747-Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

GHSA-xx8w-mq23-29g4

high2023-09-06

CVE-2023-28433-Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation

GHSA-w23q-4hw3-2pp6

high2023-09-05

CVE-2023-28434-Privilege Escalation on Linux/MacOS

GHSA-2pxw-r47w-4p8c

high2021-05-24

CVE-2020-11012-MinIO Admin API security issue

GHSA-xv4r-vccv-mg4w