Findings

CVE-2026-41145

MinIO is a high-performance object storage system.

Published Apr 22, 2026 · updated Jun 17, 2026 · minio minio

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default , or any key with WRITE permission on a bucket) and a target bucket name. and call with a signature verification gate based solely on the presence of the header. Meanwhile, extracts credentials from either the header or the query parameter, and trusts whichever it finds. An attacker omits the header and supplies credentials exclusively via the query string. The signature gate evaluates to , is never called, and the request proceeds with the permissions of the impersonated access key. This affects (standard and tables/warehouse bucket paths) and (multipart uploads). Users of the open-source project should upgrade to MinIO AIStor or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing at the reverse proxy or WAF layer. Clients can use (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.