PT-2026-34231 · Minio · Minio

Arvin Shivram + 1 · Published 2026-04-11 · Updated 2026-05-13 · CVE-2026-40344

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z

Description An authentication bypass exists in the Snowball auto-extract handler PutObjectExtractHandler. This issue allows a user with a valid access key to write arbitrary objects to any bucket without providing a secret key or a valid cryptographic signature. The flaw occurs because the switch rAuthType block in the handler lacks a case for authTypeStreamingUnsignedTrailer, causing execution to bypass signature verification. An attacker can exploit this by sending a PUT request with the header X-Amz-Content-Sha256 set to STREAMING-UNSIGNED-PAYLOAD-TRAILER, the header X-Amz-Meta-Snowball-Auto-Extract set to true, and an Authorization header containing a valid access key with a fabricated signature.

Recommendations Upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. Block unsigned-trailer requests at the load balancer by rejecting any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Restrict s3:PutObject grants to trusted principals to limit WRITE permissions.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BIT-MINIO-2026-40344

CVE-2026-40344

GHSA-9C4Q-HQ6P-C237

Affected Products

Minio

References · 10

• https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091 · Patch
• https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-minio-2026-40344 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-40344 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c4q-hq6p-c237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40344 · Security Note
• https://github.com/minio/minio/pull/16484 · Note
• https://github.com/minio/minio · Note
• https://twitter.com/CVEnew/status/2048168394797797692 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046807400431206672 · Twitter Post