minio vulnerabilities

32 published CVEs name minio among the affected products; CISA lists 2 of them as exploited in the wild.

Critical 4High 20Medium 8Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
minio · minio
ExploitedHigh8.8
CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
minio · minio
ExploitedHigh7.5

CVE-2026-97731
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list.…
MinIO · MinIO
High7.1
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
minio · minio
Medium6.9
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
minio · minio
High8.8
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
minio · minio
High8.8
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
minio · minio
High7.1
CVE-2026-34204
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
minio · minio
High7.1
CVE-2026-33419
MinIO: LDAP login brute-force via user enumeration and missing rate limit
minio · minio
Critical9.1
CVE-2026-33322
MinIO: JWT Algorithm Confusion in OIDC Authentication
minio · minio
Critical9.2
CVE-2025-62506
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
minio · minio
High8.1
CVE-2025-59952
minio-java Client XML Tag is Vulnerable to Value Substitution
minio · minio-java
High8.7