---
id: CVE-2026-97731
title: >-
  MinIO through 7aac2a2 does not verify that every x-amz-* header present on a
  request also appears in the client-supplied X-Amz-SignedHeaders list
summary: >-
  MinIO through 7aac2a2 does not verify that every x-amz-* header present on a
  request also appears in the client-supplied X-Amz-SignedHeaders list.
  extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed
  list and nev…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-347
vendor: MinIO
product: MinIO
affected:
  - MinIO <= 7aac2a2c5b7c882e68c1ce017d8256be2feea27f
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T16:17:31.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97731'
references:
  - url: >-
      https://github.com/pgsty/silo/commit/1233254309b15571f101b2b26d531951ceaeef1e
    label: cve@mitre.org
  - url: 'https://silo.pgsty.com/about/security-advisories/#sn-2026-011'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
epss: 0.00154
epssPercentile: 0.0384
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T15:22:42.586752Z'
ingestedAt: '2026-09-25T03:58:52.649Z'
---

## Overview

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.