What is CVE-2025-32963?

CVE-2025-32963 is a vulnerability in Minio Operator, classified under Insufficiently Protected Credentials. Published 2025-04-22.

Is CVE-2025-32963 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Minio Operator

CVE-2025-32963

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

EPSS: 0.006 (44.9th percentile) — read the EPSS interpretation.

Affected products

Minio Operator — versions < 7.1.0

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

Public proof-of-concept exploits

wKayaa/wwyvq4_

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-32963?: CVE-2025-32963 is a vulnerability in Minio Operator, classified under Insufficiently Protected Credentials. Published 2025-04-22.
Is CVE-2025-32963 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.