What is CVE-2021-41266?

CVE-2021-41266 is a high-severity vulnerability in Min Minio Console, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2021-11-15.

How severe is CVE-2021-41266?

High severity. CVSS v3 base score is 8.6 out of 10.

Is CVE-2021-41266 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Min Minio Console

CVE-2021-41266

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.

Vulnerability class: Broken Authentication

Published 2021-11-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

EPSS exploit prediction

EPSS: 0.484 (98.8th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.484 · newest: 0.484 · change: 0.000

Affected products

Min Minio Console
Minio Console — versions < 0.12.3

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

Public proof-of-concept exploits

References

github.com/minio/console/security/advisories/GHSA-4999-659w-mq36 (Third Party Advisory, Issue Tracking)
github.com/minio/console/pull/1217 (Exploit, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2021-41266?: CVE-2021-41266 is a high-severity vulnerability in Min Minio Console, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2021-11-15.
How severe is CVE-2021-41266?: High severity. CVSS v3 base score is 8.6 out of 10.
Is CVE-2021-41266 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.