MinIO hat einen Unauthentifizierten Objekt-Schreibzugriff über eine Query-String-Credential-Signature-Umgehung bei Unsigned-Trailer-Uploads

The impact of CVE-2026-41145 is severe due to the ease of exploitation and the potential for widespread data compromise. An attacker only needs a valid access key – which could be a default key like minioadmin or a key with WRITE permissions on a bucket – and the target bucket name to execute the attack. This bypass circumvents MinIO's intended security controls, allowing unauthorized modification or creation of objects within the storage system. The potential consequences include data corruption, malicious file uploads, and the introduction of backdoors. This vulnerability shares similarities with other object storage bypasses where improper signature validation or access control enforcement leads to unauthorized access.

Organizations utilizing MinIO for object storage, particularly those using the default minioadmin access key or those with overly permissive access controls, are at significant risk. Shared hosting environments where multiple users share MinIO buckets are also particularly vulnerable, as a compromised user account could be leveraged to exploit this vulnerability.

• linux / server:

journalctl -u minio -g 'STREAMING-UNSIGNED-PAYLOAD-TRAILER'

• generic web:

curl -I https://<minio_endpoint>/<bucket_name>/<object_name> -H "X-Minio-Access-Key: <valid_access_key>" -H "X-Minio-Signature: "

• linux / server:

lsof -i :9000 | grep minio

1. 2026-04-22Disclosure

   disclosure

2. 2026-04-11Patch

   patch

1. Reserviert2026-04-17
2. Veröffentlicht2026-04-22
3. EPSS aktualisiert2026-04-29

The primary mitigation for CVE-2026-41145 is to immediately upgrade MinIO to version 2026-04-11T03-20-12Z or later. If an immediate upgrade is not feasible, consider temporarily restricting access to sensitive buckets and reviewing existing access keys for potential compromise. While not a direct fix, implementing a Web Application Firewall (WAF) with rules to inspect and block requests lacking valid signatures can provide a temporary layer of defense. Monitor MinIO logs for unusual object creation or modification activity, particularly from unexpected sources. After upgrading, confirm the fix by attempting to create an object in a sensitive bucket using an access key without the corresponding secret key; the operation should fail with an authentication error.