PT-2026-28605 · Minio · Minio Aistor+1
Harshavardhana
·
Published
2026-03-27
·
Updated
2026-04-07
·
CVE-2026-34204
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
MinIO versions prior to RELEASE.2026-03-26T21-24-40Z
Description
A flaw in the
extractMetadataFromMime() function allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects. This is achieved by sending crafted X-Minio-Replication-* headers on a normal PutObject request. The server incorrectly maps these headers to internal encryption metadata without verifying the request's legitimacy. Objects written in this manner become permanently unreadable through the S3 API. The issue was introduced in commit 468a9fae83e965ecefa1c1fdc2fc57b84ece95b0 on 2024-03-28. The affected component is cmd/handler-utils.go.Recommendations
Upgrade to MinIO AIStor version RELEASE.2026-03-26T21-24-40Z or later.
If upgrading is not immediately possible, restrict replication headers at a reverse proxy or load balancer by dropping or rejecting any request containing
X-Minio-Replication-Server-Side-Encryption-* headers that does not also carry X-Minio-Source-Replication-Request.
Audit IAM policies and limit s3:PutObject grants to trusted principals.Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Minio
Minio Aistor