{"id":"CVE-2026-97731","revision":"5135a1a7253b4c06a3b5c7a05829f879","records":[{"revision":"5135a1a7253b4c06a3b5c7a05829f879","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97731","aliases":[],"title":"MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never …","description":"MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.","state":0,"publishedAt":"2026-09-25T03:07:30.661+00:00","modifiedAt":"2026-09-25T15:22:53.901+00:00","affected":[{"ecosystem":"Vendor product","name":"MinIO","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"MinIO\",\n                    \"repo\": \"https://github.com/minio/minio\",\n                    \"vendor\": \"MinIO\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"7aac2a2c5b7c882e68c1ce017d8256be2feea27f\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","score":7.1,"severity":"HIGH"}],"references":["https://silo.pgsty.com/about/security-advisories/#sn-2026-011","https://github.com/pgsty/silo/commit/1233254309b15571f101b2b26d531951ceaeef1e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97731","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97731","identifiers":["CVE-2026-97731"]},"retained":false,"historicalAffected":[]}],"coverage":[]}