MinIO signature check flaw allows cross-bucket reads
MinIO file storage servers can leak files from other storage areas.
Summary
MinIO accepts unsigned x-amz headers, so a presigned PUT URL can be escalated into reading another bucket. Versions up to and including RELEASE.2026-09-21T00-15-41Z are affected.
Affected when
- Presigned PUT URLs in use
What to do
Check that you run a version newer than RELEASE.2026-09-21T00-15-41Z and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen