Auth bypass in Minio

CVE-2026-34204

MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption meta…

Vulnerability class: Broken Authentication

EPSS: 0.000 (8.8th percentile) — read the EPSS interpretation.

Affected products

Minio — versions < RELEASE.2026-03-26T21-24-40Z

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

https://github.com/minio/minio/security/advisories/GHSA-3rh2-v3gr-35p9 (x_refsource_CONFIRM)