CVE-2026-40344: 
MinIO vulnerability analysis and mitigation

CVE-2026-40344 is an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (PutObjectExtractHandler) that allows any user with a valid access key to write arbitrary objects to any bucket without providing a valid cryptographic signature. It affects all MinIO releases from RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z (exclusive). The vulnerability was disclosed on April 11, 2026, by Arvin Shivram of Brutecat Security and published via GitHub Security Advisory on April 22, 2026. It carries a CVSS v3.1 score of 8.2 (High) and a CVSS v4.0 score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). When authTypeStreamingUnsignedTrailer support was introduced in commit 76913a9 (PR #16484, merged May 2023), it was correctly handled in PutObjectHandler and PutObjectPartHandler but was never added to PutObjectExtractHandler in cmd/object-handlers.go. As a result, the handler's switch rAuthType block has no case for authTypeStreamingUnsignedTrailer, causing execution to fall through with zero signature verification. The isPutActionAllowed call preceding the switch validates IAM permissions using the access key but does not verify the cryptographic signature, meaning an attacker can supply a fabricated signature alongside a valid access key and the request will be accepted (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to extract a tar payload containing arbitrary objects into any MinIO bucket without authorization, enabling data tampering, unauthorized file injection, and potential system compromise through malicious object placement. The integrity impact is rated High, as an attacker can overwrite or inject any object into any bucket; availability impact is Low due to potential storage disruption from injected data. Confidentiality is not directly impacted by this vulnerability, though injected malicious objects could serve as a foothold for further compromise of systems consuming bucket contents (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.00154, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only a valid access key (including the well-known default minioadmin) and a target bucket name, making it low-complexity and requiring no privileges beyond a basic access key (GitHub Advisory).

1. Reconnaissance: Identify internet-facing MinIO instances running versions between RELEASE.2023-05-18T00-05-36Z and RELEASE.2026-04-11T03-20-12Z using tools like Shodan or Censys, searching for MinIO server banners or S3-compatible endpoints.
2. Obtain a valid access key: Acquire any valid MinIO access key — this could be the default minioadmin credential on misconfigured deployments, or any key with s3:PutObject (WRITE) permission on a target bucket.
3. Identify a target bucket: Enumerate accessible bucket names via the MinIO API or S3-compatible list operations using the valid access key.
4. Craft the malicious PUT request: Construct a PUT request to the target bucket with the following headers:
   • X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER
   • X-Amz-Meta-Snowball-Auto-Extract: true
   • Authorization header containing the valid access key with a completely fabricated HMAC signature
5. Prepare the tar payload: Package the arbitrary objects to be injected into a tar archive as the request body.
6. Send the request: Submit the crafted PUT request to the MinIO endpoint. The PutObjectExtractHandler falls through signature verification and accepts the request, extracting the tar payload into the target bucket.
7. Achieve objective: Injected objects are now present in the bucket, enabling data tampering, supply chain attacks on downstream consumers, or placement of malicious files (GitHub Advisory, Feedly).

• Network: Unexpected PUT requests to MinIO endpoints containing both X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER and X-Amz-Meta-Snowball-Auto-Extract: true headers; PUT requests with Authorization headers where the HMAC signature does not correspond to the request content.
• Logs: MinIO access logs showing successful PUT requests with snowball-auto-extract metadata from unexpected source IPs or at unusual times; requests where the Authorization header access key does not match any known legitimate client.
• File System / Object Storage: Unexpected or unauthorized objects appearing in MinIO buckets, particularly tar-extracted file trees; objects with unusual metadata or naming patterns inconsistent with normal application uploads.
• Process/Application: MinIO server logs showing PutObjectExtractHandler invocations without corresponding valid signature verification entries.

The primary remediation is to upgrade MinIO to RELEASE.2026-04-11T03-20-12Z or later (MinIO AIStor), which adds proper authTypeStreamingUnsignedTrailer handling to PutObjectExtractHandler (GitHub Advisory). If immediate patching is not possible, the following workarounds should be applied in priority order:

• Block unsigned-trailer requests: Configure the reverse proxy or WAF to reject any request containing the header X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER.
• Enforce signed uploads: Configure clients to use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead of the unsigned trailer.
• Restrict WRITE permissions: Limit s3:PutObject grants to trusted principals only — note this reduces attack surface but does not eliminate the vulnerability, as any user with WRITE permission can exploit it with only their access key (Feedly).

The vulnerability was credited to Arvin Shivram of Brutecat Security (@ddd) and the advisory was published by MinIO maintainer harshavardhana on April 11, 2026 (GitHub Advisory). Coverage appeared on security aggregators including infinitsec.net, VulDB, and INCIBE-CERT shortly after disclosure. The MinIO repository was archived by its owner on April 25, 2026, with users directed to MinIO AIStor for the patched release.