CVE-2026-41145: 
MinIO vulnerability analysis and mitigation

CVE-2026-41145 is an authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path, allowing any user with a valid access key to write arbitrary objects to any bucket without providing a valid cryptographic signature or knowing the secret key. The vulnerability was introduced in commit 76913a9fd (PR #16484, merged May 6, 2023) and affects all MinIO releases from RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z (exclusive). It was disclosed via GitHub Security Advisory GHSA-hv4r-mvr4-25vw on April 14, 2026, and published to NVD on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is improper authentication (CWE-287) stemming from a logic flaw in how PutObjectHandler and PutObjectPartHandler gate signature verification. Specifically, newUnsignedV4ChunkedReader is called with a boolean flag set to true only when the Authorization HTTP header is present — but isPutActionAllowed independently extracts credentials from either the Authorization header or the X-Amz-Credential query parameter, trusting whichever it finds. An attacker exploits this by omitting the Authorization header entirely and supplying credentials solely via the X-Amz-Credential query string parameter; the signature gate evaluates to false, doesSignatureMatch is never invoked, and the request proceeds with the full permissions of the impersonated access key. This affects both standard object uploads (PutObjectHandler, including tables/warehouse bucket paths) and multipart uploads (PutObjectPartHandler), and requires only network access with no user interaction (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to inject arbitrary objects into any bucket across the entire MinIO deployment without cryptographic authorization, resulting in a high integrity impact and low availability impact with no confidentiality impact. An attacker with knowledge of only a valid access key — including the well-known default minioadmin credential — can overwrite, corrupt, or inject malicious content into stored objects, potentially affecting downstream applications that consume data from the storage system. The attack is fully network-accessible, requires no user interaction, and can be automated at scale against any exposed MinIO instance (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability was discovered by Arvin Shivram of Brutecat Security (@ddd) and reported responsibly to the MinIO team (GitHub Advisory). The EPSS score is approximately 0.113%, indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. However, the low attack complexity, no privileges required beyond a valid access key, and the prevalence of default credentials (minioadmin) make this a high-priority patching target.

1. Reconnaissance: Identify internet-facing MinIO instances running versions between RELEASE.2023-05-18T00-05-36Z and RELEASE.2026-04-11T03-20-12Z using tools like Shodan or Censys, searching for MinIO server banners or S3-compatible API endpoints.
2. Obtain a valid access key: Use the well-known default access key minioadmin (if the deployment has not changed defaults), or obtain any valid access key with s3:PutObject (WRITE) permission through other means (e.g., leaked credentials, insider knowledge).
3. Identify a target bucket: Enumerate accessible bucket names via the S3 ListBuckets API or through prior knowledge of the deployment.
4. Craft a malicious PUT request: Construct an HTTP PUT request to the MinIO endpoint targeting a specific object key in the target bucket. Set the header X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER to trigger the vulnerable code path. Supply credentials exclusively via the query string using the X-Amz-Credential parameter (e.g., ?X-Amz-Credential=minioadmin%2F...). Omit the Authorization HTTP header entirely.
5. Bypass signature verification: Because the Authorization header is absent, the signature gate in newUnsignedV4ChunkedReader evaluates to false, and doesSignatureMatch is never called. The request proceeds with the permissions of the impersonated access key.
6. Write arbitrary object: The server accepts and stores the attacker-supplied object content in the target bucket, enabling data injection, content tampering, or overwriting of existing objects (GitHub Advisory, Feedly).

• Network: Inbound HTTP PUT requests to MinIO S3 API endpoints that include the header X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER but lack an Authorization HTTP header; PUT requests with X-Amz-Credential supplied as a query string parameter rather than in the Authorization header.
• Logs: MinIO access logs showing successful PutObject or UploadPart operations where the request URL contains X-Amz-Credential as a query parameter without a corresponding Authorization header; unexpected object creation or modification events in audit logs, especially from unfamiliar source IPs.
• File System / Storage: Unexpected or newly created objects in buckets, particularly objects with unusual names, content types, or sizes inconsistent with normal application behavior; overwritten objects with altered content that may indicate tampering.
• Behavioral: Repeated PUT requests using the default minioadmin access key from external or unexpected IP addresses; bulk object writes occurring outside of normal operational hours or from non-standard client user agents (GitHub Advisory, Feedly).

Primary remediation: Upgrade MinIO to RELEASE.2026-04-11T03-20-12Z (MinIO AIStor) or later, which contains the fix for this vulnerability (GitHub Advisory). If immediate upgrading is not possible, apply the following interim mitigations:

• Block unsigned-trailer requests at the perimeter: Configure your reverse proxy or WAF to reject any request containing the header X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER.
• Enforce signed uploads: Require clients to use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead of the unsigned trailer path.
• Restrict WRITE permissions: Limit s3:PutObject grants to only explicitly trusted principals and rotate or change the default minioadmin credentials immediately. Note that this reduces attack surface but does not eliminate the vulnerability for any user with WRITE access (GitHub Advisory, Feedly).

The vulnerability was credited to Arvin Shivram of Brutecat Security (@ddd), with remediation developed by MinIO's donatello and reviewed by harshavardhana (GitHub Advisory). A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). The vulnerability received coverage from standard CVE tracking feeds and vulnerability databases, but no major vendor statements or widespread social media discussion have been observed beyond routine CVE publication activity.