Advisories · Technology
MinIO.
Every CVE that names MinIO among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
- MinIO
- Hard-coded credentials
- CWE-320
- CVSS 7.1 High
Improper signature verification in MinIO
- MinIO
- Weak cryptography or TLS
- CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV
Minio Information Disclosure in Cluster Deployment
- minio
- Information disclosure
- CVSS 6.5 Medium
Minio vulnerable to denial of access by an admin privileged user for root credential
- minio
- Privilege escalation
- CVSS 6.5 Medium
Allowed DELETE on resources on object locked buckets under Governance mode in Minio
- minio
- CWE-281
- CVSS 7.4 HighCritical · CVSS 7+ and EPSS
Authenticated requests for server update admin API allows path traversal in minio
- minio
- Path traversal
- CVSS 7.5 High
Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO
- minio
- Denial of service
- CVSS 8.8 High
Improper Privilege Management in MinIO
- minio
- Privilege escalation
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
User privilege escalation in MinIO
- minio
- Privilege escalation
- CVSS 8.8 High
Bypassing policy restrictions on regular users
- minio
- Broken access control
- CVSS 6.5 Medium
MITM modification of request bodies in MinIO
- minio
- CWE-924
- CVSS 7.7 High
Bypassing readOnly policy by creating a temporary 'mc share upload' URL
- minio
- Broken access control
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
Server-Side Request Forgery in MinIO Browser API
- minio
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Authentication bypass MinIO Admin API
- minio
- CWE-305