CVE-2026-41145
MinIO is a high-performance object storage system.
Published Apr 22, 2026 · corrected/updated Jun 17, 2026 · minio minio · evidence confidence medium
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default , or any key with WRITE permission on a bucket) and a target bucket name. and call with a signature verification gate based solely on the presence of the header. Meanwhile, extracts credentials from either the header or the query parameter, and trusts whichever it finds. An attacker omits the header and supplies credentials exclusively via the query string. The signature gate evaluates to , is never called, and the request proceeds with the permissions of the impersonated access key. This affects (standard and tables/warehouse bucket paths) and (multipart uploads). Users of the open-source project should upgrade to MinIO AIStor or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing at the reverse proxy or WAF layer. Clients can use (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-41145 is a high public vulnerability record for minio minio. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether minio minio is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: minio/minio. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 8.8. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-287. Sources contributing to this record: cve_org, nvd. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The atta
Jun 17, 2026 · NIST NVD
Updated
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The atta
Affected
- cpe minio/minioversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41145
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41145
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's code path allows any user who knows a valid access key to
nvd.nist.gov