{"id":"CVE-2026-113466","title":"MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key","summary":"A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such ma…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-321","CWE-320"],"product":"MinIO","affected":["MinIO RELEASE.2025-10-15T17-29-55Z"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-20T15:30:24.330809Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:31:34.898Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113466","references":[{"url":"https://vuldb.com/vuln/422691","label":"VDB-422691 | MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key"},{"url":"https://vuldb.com/vuln/422691/cti","label":"VDB-422691 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-113466","label":"CVE-2026-113466 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1004925","label":"Submit #1004925 | MinIO <=RELEASE.2025-10-15T17-29-55Z Use of Hard-coded Cryptographic Key"},{"url":"https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-20T15:09:24.115Z","slug":"CVE-2026-113466","body":"## Overview\n\nA security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key\r . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.\n\n## Affected\n\n- `MinIO RELEASE.2025-10-15T17-29-55Z`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":225962,"id":"CVE-2026-113466","ts":1792512728697,"field":"exploit_available","old":"false","new":"true"}]}