CVE-2025-31489High▾ MidnightPoC availableMinIO performs incomplete signature validation for unsigned-trailer uploads
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.4%
2.4% → 2.4%
Nuclei ×1
This is a high priority vulnerability and users must upgrade ASAP.
The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket,
Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary.
However with relevant information in place, uploading random objects to buckets is trivial and easy via curl
Yes https://github.com/minio/minio/pull/21103
Reject requests with x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER for now at LB layer, ask application users to use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER
github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9Upgrade to a patched release:
github.com/minio/minio 0.0.0-20250403145552-8c70975283f9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-28434High· 8.8Privilege Escalation on Linux/MacOS
CVE-2026-33322CriticalMinIO has JWT Algorithm Confusion in OIDC Authentication
CVE-2026-34204High· 7.1MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
CVE-2026-39414HighMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing