MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. `PutObjectHandler` and `PutObjectPartHandler` call `newUnsignedV4ChunkedReader` with a signature verification gate based solely on the presence of the `Authorization` header. Meanwhile, `isPutActionAllowed` extracts credentials from either the `Authorization` header or the `X-Amz-Credential` query parameter, and trusts whichever it finds. An attacker omits the `Authorization` header and supplies credentials exclusively via the query string. The signature gate evaluates to `false`, `doesSignatureMatch` is never called, and the request proceeds with the permissions of the impersonated access key. This affects `PutObjectHandler` (standard and tables/warehouse bucket paths) and `PutObjectPartHandler` (multipart uploads). Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-04-11T03-20-12Z` or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` at the reverse proxy or WAF layer. Clients can use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit `s3:PutObject` grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to
    RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's `STREAMING-UNSIGNED-
    PAYLOAD-TRAILER` code path allows any user who knows a valid access key to write arbitrary objects to any
    bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment
    is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key
    with WRITE permission on a bucket) and a target bucket name. `PutObjectHandler` and `PutObjectPartHandler`
    call `newUnsignedV4ChunkedReader` with a signature verification gate based solely on the presence of the
    `Authorization` header. Meanwhile, `isPutActionAllowed` extracts credentials from either the
    `Authorization` header or the `X-Amz-Credential` query parameter, and trusts whichever it finds. An
    attacker omits the `Authorization` header and supplies credentials exclusively via the query string. The
    signature gate evaluates to `false`, `doesSignatureMatch` is never called, and the request proceeds with
    the permissions of the impersonated access key. This affects `PutObjectHandler` (standard and
    tables/warehouse bucket paths) and `PutObjectPartHandler` (multipart uploads). Users of the open-source
    `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-04-11T03-20-12Z` or later. If upgrading
    is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request
    containing `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` at the reverse proxy or WAF layer.
    Clients can use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` (the signed variant) instead. Alternatively,
    restrict WRITE permissions. Limit `s3:PutObject` grants to trusted principals. While this reduces the
    attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit
    it with only their access key. (CVE-2026-41145)

ID	Name	Product	Family	Type	Severity
446658	SCA: security update for github.com/minio/minio (GHSA-hv4r-mvr4-25vw)	Tenable Cloud Security	SCA Checks	Local	high
446658	SCA: security update for github.com/minio/minio (GHSA-hv4r-mvr4-25vw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-41145

high

Tenable Plugins

high

high