CVE-2026-113466

medium

Description

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

References

https://vuldb.com/vuln/422691/cti

https://vuldb.com/vuln/422691

https://vuldb.com/submit/1004925

https://vuldb.com/cve/CVE-2026-113466

https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105033

Details

Source: Mitre, NVD

Published: 2026-10-20

Updated: 2026-10-20

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00377