PT-2026-34234 · Minio · Minio

Arvin Shivram + 2 · Published 2026-04-14 · Updated 2026-05-13 · CVE-2026-41145

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z

Description An authentication bypass exists in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path. An attacker possessing a valid access key can write arbitrary objects to any bucket without a secret key or a valid cryptographic signature. The issue occurs because PutObjectHandler and PutObjectPartHandler utilize newUnsignedV4ChunkedReader with a signature verification gate that relies only on the Authorization header. Simultaneously, isPutActionAllowed accepts credentials from either the Authorization header or the X-Amz-Credential query parameter. By omitting the Authorization header and providing credentials via the query string, the signature gate is bypassed, and the request is processed using the permissions of the impersonated access key. This affects standard and tables/warehouse bucket paths as well as multipart uploads.

Recommendations Upgrade to MinIO AIStor version RELEASE.2026-04-11T03-20-12Z or later. Block unsigned-trailer requests at the load balancer by rejecting any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Restrict s3:PutObject grants to trusted principals to limit WRITE permissions.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-MINIO-2026-41145

CVE-2026-41145

GHSA-HV4R-MVR4-25VW

Affected Products

Minio

References · 9

• https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091 · Patch
• https://github.com/minio/minio/security/advisories/GHSA-hv4r-mvr4-25vw · Vendor Advisory
• https://osv.dev/vulnerability/BIT-minio-2026-41145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41145 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-41145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hv4r-mvr4-25vw · Vendor Advisory
• https://github.com/minio/minio/pull/16484 · Note
• https://github.com/minio/minio · Note
• https://twitter.com/CVEnew/status/2048168393984168008 · Twitter Post