CVE-2026-42600 | Medium | 4.9 | 2026-05-11 | MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in… |
CVE-2026-41145 | High | 8.2 | 2026-04-22 | MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass… |
CVE-2026-40344 | High | 8.2 | 2026-04-22 | MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass… |
CVE-2026-39414 | Medium | 6.5 | 2026-04-08 | MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulne… |
CVE-2026-34204 | High | 7.1 | 2026-03-31 | MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated… |
CVE-2026-33419 | High | 7.5 | 2026-03-24 | MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit… |
CVE-2026-33322 | Critical | 9.8 | 2026-03-24 | MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerab… |
CVE-2025-62506 | High | 8.1 | 2025-10-16 | MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service a… |
CVE-2025-59952 | | | 2025-09-30 | MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio… |
CVE-2025-32963 | | | 2025-04-22 | MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the defa… |
CVE-2025-31489 | | | 2025-04-03 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid… |
CVE-2025-27414 | | | 2025-02-28 | MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to
RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust… |
CVE-2024-55949 | | | 2024-12-16 | MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, a… |
CVE-2024-36107 | Medium | 5.3 | 2024-05-28 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when us… |
CVE-2024-24747 | High | 8.8 | 2024-01-31 | MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but… |
CVE-2023-33955 | Medium | 4.3 | 2023-05-30 | Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patc… |
CVE-2023-28434 | High | 8.8 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name che… |
CVE-2023-28433 | High | 8.8 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\`… |
CVE-2023-28432 | High | 7.5 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z… |
CVE-2023-27589 | Medium | 6.5 | 2023-03-14 | Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmi… |
CVE-2023-25812 | Medium | 6.5 | 2023-02-21 | Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Acc… |
CVE-2022-35919 | High | 7.4 | 2022-08-01 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin… |
CVE-2022-31028 | High | 7.5 | 2022-06-07 | MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO… |
CVE-2022-24842 | High | 8.8 | 2022-04-12 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to… |
CVE-2021-43858 | High | 8.8 | 2021-12-27 | MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call… |
CVE-2021-41266 | High | 8.6 | 2021-11-15 | Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to… |
CVE-2021-41137 | High | 8.8 | 2021-10-13 | Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves b… |
CVE-2021-21390 | Medium | 6.5 | 2021-03-19 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2021-21287 | High | 7.7 | 2021-02-01 | MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side requ… |
CVE-2020-11012 | Critical | 9.3 | 2020-04-23 | MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to per… |
CVE-2018-1000538 | High | 7.5 | 2018-06-26 | Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vuln… |