{"id":"GO-2025-3495","revision":"404d185c39e7495885bb71924f4d3903","records":[{"revision":"404d185c39e7495885bb71924f4d3903","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3495","aliases":["CVE-2025-27414","GHSA-wc79-7x8x-2p58"],"title":"MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio","description":"MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/minio/minio from RELEASE.2024-06-06T09-36-42Z before RELEASE.2025-02-28T09-55-16Z.","state":0,"publishedAt":"2025-03-03T19:22:09+00:00","modifiedAt":"2026-10-08T08:11:01.8835639+00:00","affected":[{"ecosystem":"Go","name":"github.com/minio/minio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-27414","https://github.com/minio/minio/commit/4c71f1b4ec0fb2a473ddaac18c20ec9e63f267ec","https://github.com/minio/minio/commit/91e1487de45720753c9e9e4c02b1bd16b7e452fa","https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3495","license":"OSV · upstream source license applies","key":"osv:GO-2025-3495","identifiers":["GO-2025-3495","CVE-2025-27414","GHSA-wc79-7x8x-2p58"]},"retained":false,"historicalAffected":[]}],"coverage":[]}