PT-2025-17524 · Minio · Minio Operator

Bburky · Published 2025-04-21 · Updated 2025-04-23 · CVE-2025-32963

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO Operator versions prior to 7.1.0

Description The issue concerns the MinIO Operator STS, a native IAM Authentication for Kubernetes. Without proper scoping, authentication can be replayed to other internal systems that may unintentionally trust it. This occurs when no audiences are provided for the spec.audiences field, defaulting to the Kubernetes apiserver.

Recommendations For versions prior to 7.1.0, update to version 7.1.0 to resolve the issue. As a temporary workaround, consider specifying audiences for the spec.audiences field to prevent defaulting to the Kubernetes apiserver.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-09079

CVE-2025-32963

GHSA-7M6V-Q233-Q9J9

GO-2025-3637

OPENSUSE-SU-2025:15017-1

Affected Products

Minio Operator

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32963.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32963 · Security Note
• https://bdu.fstec.ru/vul/2025-09079 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32963 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7m6v-q233-q9j9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3637 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-7m6v-q233-q9j9/GHSA-7m6v-q233-q9j9.json · Note
• https://github.com/minio/operator/commit/d586294d526bf0d8e6097225114655f68b0adcc5 · Note
• https://github.com/minio/operator/releases/tag/v7.1.0 · Note
• https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 · Note
• https://github.com/minio/operator · Note
• https://suse.com/security/cve/CVE-2025-32093 · Note
• https://suse.com/security/cve/CVE-2025-32445 · Note
• https://twitter.com/CVEnew/status/1914734351318757860 · Twitter Post