# MinIO.

Every CVE that names MinIO among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key](https://agentprime.io/advisories/CVE-2026-113466.md)
  `CVE-2026-113466` · CVE record: MinIO · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [Improper signature verification in MinIO](https://agentprime.io/advisories/CVE-2026-97731.md)
  `CVE-2026-97731` · CVE record: MinIO MinIO · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Weak cryptography or TLS
- [Minio Information Disclosure in Cluster Deployment](https://agentprime.io/advisories/CVE-2023-28432.md)
  `CVE-2023-28432` · CVE record: minio minio · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.84 · Not analysed yet · Published 22 Mar 2023 · Tags: Information disclosure
- [Minio vulnerable to denial of access by an admin privileged user for root credential](https://agentprime.io/advisories/CVE-2023-27589.md)
  `CVE-2023-27589` · CVE record: minio minio · CVSS 6.5 Medium · Not analysed yet · Published 14 Mar 2023 · Tags: Privilege escalation
- [Allowed DELETE on resources on object locked buckets under Governance mode in Minio](https://agentprime.io/advisories/CVE-2023-25812.md)
  `CVE-2023-25812` · CVE record: minio minio · CVSS 6.5 Medium · Not analysed yet · Published 21 Feb 2023 · Tags: CWE-281
- [Authenticated requests for server update admin API allows path traversal in minio](https://agentprime.io/advisories/CVE-2022-35919.md)
  `CVE-2022-35919` · CVE record: minio minio · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.52 · Not analysed yet · Published 1 Aug 2022 · Tags: Path traversal
- [Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO](https://agentprime.io/advisories/CVE-2022-31028.md)
  `CVE-2022-31028` · CVE record: minio minio · CVSS 7.5 High · Not analysed yet · Published 3 Jun 2022 · Tags: Denial of service
- [Improper Privilege Management in MinIO](https://agentprime.io/advisories/CVE-2022-24842.md)
  `CVE-2022-24842` · CVE record: minio minio · CVSS 8.8 High · Not analysed yet · Published 12 Apr 2022 · Tags: Privilege escalation
- [User privilege escalation in MinIO](https://agentprime.io/advisories/CVE-2021-43858.md)
  `CVE-2021-43858` · CVE record: minio minio · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 27 Dec 2021 · Tags: Privilege escalation
- [Bypassing policy restrictions on regular users](https://agentprime.io/advisories/CVE-2021-41137.md)
  `CVE-2021-41137` · CVE record: minio minio · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2021 · Tags: Broken access control
- [MITM modification of request bodies in MinIO](https://agentprime.io/advisories/CVE-2021-21390.md)
  `CVE-2021-21390` · CVE record: minio minio · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2021 · Tags: CWE-924
- [Bypassing readOnly policy by creating a temporary 'mc share upload' URL](https://agentprime.io/advisories/CVE-2021-21362.md)
  `CVE-2021-21362` · CVE record: minio minio · CVSS 7.7 High · Not analysed yet · Published 8 Mar 2021 · Tags: Broken access control
- [Server-Side Request Forgery in MinIO Browser API](https://agentprime.io/advisories/CVE-2021-21287.md)
  `CVE-2021-21287` · CVE record: minio minio · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 1 Feb 2021 · Tags: Server-side request forgery (SSRF)
- [Authentication bypass MinIO Admin API](https://agentprime.io/advisories/CVE-2020-11012.md)
  `CVE-2020-11012` · CVE record: MinIO minio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2020 · Tags: CWE-305

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=minio>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/minio/>. Everything for agents: <https://agentprime.io/llms.txt>.