MI
Product
minio
On CISA KEVExploited in the wild
30
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 19Medium 8Low 1
Watch
Add minio to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-28434 In wildKEV | 8.8 | Mar 22 | MinIO is vulnerable to privilege escalation on Linux/MacOS Affected: < RELEASE.2023-03-20T20-16-18Z |
| CVE-2023-28432 In wildKEV | 7.5 | Mar 22 | Minio Information Disclosure in Cluster Deployment Affected: >= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z |
| CVE-2024-24747 | 8.8 | Jan 31 | MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation Affected: < RELEASE.2024-01-31T20-20-33Z |
| CVE-2023-28433 | 8.8 | Mar 22 | Minio Privilege Escalation on Windows via Path separator manipulation Affected: < RELEASE.2023-03-20T20-16-18Z |
| CVE-2023-25812 | 8.8 | Feb 21 | Allowed DELETE on resources on object locked buckets under Governance mode in Minio Affected: >= RELEASE.2020-04-10T03-34-42Z, < RELEASE.2023-02-17T17-52-43Z |
| CVE-2022-24842 | 8.8 | Apr 12 | Improper Privilege Management in MinIO Affected: < RELEASE.2022-04-12T06-55-35Z |
| CVE-2021-43858 | 8.8 | Dec 27 | User privilege escalation in MinIO Affected: < RELEASE.2021-12-27T07-23-18Z |
| CVE-2021-41137 | 8.8 | Oct 13 | Minio is a Kubernetes native application for cloud storage Affected: 2021-10-10t16-53-30z |
| CVE-2025-31489 | 8.7 | Apr 3 | MinIO performs incomplete signature validation for unsigned-trailer uploads Affected: < RELEASE.2025-04-03T14-56-28Z |
| CVE-2026-41145 | 8.2 | Apr 22 | MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads Affected: >= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z |
| CVE-2026-40344 | 8.2 | Apr 22 | MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads Affected: >= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z |
| CVE-2025-62506 | 8.1 | Oct 16 | MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS Affected: < RELEASE.2025-10-15T17-29-55Z |
| CVE-2021-21287 | 7.7 | Feb 1 | MinIO is a High Performance Object Storage released under Apache License v2.0 Affected: before 2021-01-30t00-20-58z |
| CVE-2026-33419 | 7.5 | Mar 24 | MinIO: LDAP login brute-force via user enumeration and missing rate limit Affected: < RELEASE.2026-03-17T21-25-16Z |
| CVE-2022-31028 | 7.5 | Jun 3 | Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO Affected: >= RELEASE.2019-09-25T18-25-51Z, < RELEASE.2022-06-02T02-11-04Z |
| CVE-2020-11012 | 7.5 | Apr 23 | MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API Affected: before 2020-04-23t00-58-49z |
| CVE-2018-1000538 | 7.5 | Jun 26 | Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in… Affected: before 2018-05-16t23-35-33z |
| CVE-2026-97731 | 7.1 | Sep 25 | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list Affected: through 7aac2a2c5b7c882e68c1ce017d8256be2feea27f |
| CVE-2026-34204 | 7.1 | Mar 31 | MinIO is Vulnerable to SSE Metadata Injection via Replication Headers Affected: < RELEASE.2026-03-26T21-24-40Z |
Showing 19