{"id":"EUVD-2026-24581","enisaUuid":"9ccecb9b-ed1c-3e5b-af9d-4af4091578cb","description":"MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO\u0027s `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path\nallows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. `PutObjectHandler` and `PutObjectPartHandler` call `newUnsignedV4ChunkedReader` with a signature verification gate based solely on the presence of the `Authorization` header. Meanwhile, `isPutActionAllowed` extracts credentials from either the `Authorization` header or the\n`X-Amz-Credential` query parameter, and trusts whichever it finds. An attacker omits the `Authorization` header and supplies credentials exclusively via the query string. The signature gate evaluates to `false`, `doesSignatureMatch` is never called, and the request proceeds with the permissions of the impersonated access key. This affects `PutObjectHandler` (standard and tables/warehouse bucket paths) and `PutObjectPartHandler` (multipart uploads). Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-04-11T03-20-12Z` or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` at the reverse proxy or WAF layer. Clients can use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit `s3:PutObject` grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.","datePublished":"Apr 22, 2026, 12:54:09 AM","dateUpdated":"Apr 22, 2026, 2:21:43 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-hv4r-mvr4-25vw\nhttps://github.com/minio/minio/pull/16484\nhttps://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091\n","aliases":"CVE-2026-41145\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"debfe259-cca3-361b-bc2d-ad0eec18cd76","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2023-05-18T00-05-36Z, \u003c RELEASE.2026-04-11T03-20-12Z"}],"enisaIdVendor":[{"id":"a3808d50-136f-335f-b3e2-15b274542ed2","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"c3a28d05-d5fa-3eca-b3b4-1503870fbbb6","vulnerability":{"id":"CVE-2026-41145","description":"MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO\u0027s `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path\nallows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. `PutObjectHandler` and `PutObjectPartHandler` call `newUnsignedV4ChunkedReader` with a signature verification gate based solely on the presence of the `Authorization` header. Meanwhile, `isPutActionAllowed` extracts credentials from either the `Authorization` header or the\n`X-Amz-Credential` query parameter, and trusts whichever it finds. An attacker omits the `Authorization` header and supplies credentials exclusively via the query string. The signature gate evaluates to `false`, `doesSignatureMatch` is never called, and the request proceeds with the permissions of the impersonated access key. This affects `PutObjectHandler` (standard and tables/warehouse bucket paths) and `PutObjectPartHandler` (multipart uploads). Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-04-11T03-20-12Z` or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` at the reverse proxy or WAF layer. Clients can use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit `s3:PutObject` grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.","datePublished":"Apr 22, 2026, 12:54:09 AM","dateUpdated":"Apr 22, 2026, 2:21:43 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-hv4r-mvr4-25vw\nhttps://github.com/minio/minio/pull/16484\nhttps://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091\n","enisa_id":"EUVD-2026-24581\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"a7899548-aabe-33e4-8698-133c4ff9f365","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2023-05-18T00-05-36Z, \u003c RELEASE.2026-04-11T03-20-12Z"}],"vulnerabilityVendor":[{"id":"1d52299c-21c9-3a2c-880b-d353bc426fb2","vendor":{"name":"minio"}}]}}],"enisaIdAdvisory":[{"id":"e5521241-40fd-3d17-8f9f-774ae89018d3","advisory":{"id":"WID-SEC-W-2026-1081","description":"MinIO: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen","summary":"Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MinIO ausnutzen, um die Authentifizierung zu umgehen und Daten zu manipulieren.","datePublished":"Apr 13, 2026, 10:00:00 PM","dateUpdated":"Apr 21, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1081.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1081\n","aliases":"CVE-2026-40344\nCVE-2026-41145\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"42ecc8e1-54fd-3d4f-8932-f94e48366437","product":{"name":"2026-04-11T03-20-12Z","vendor":{"name":"open source"}}},{"id":"f7846b43-b5c9-3270-a11c-d0e7ca9cf9ff","product":{"name":"minio","vendor":{"name":"minio"}}}]}}]}