CVE-2026-40344: Authentication Bypass in MinIO

The impact of CVE-2026-40344 is severe. An attacker possessing a valid MinIO access key (such as the default minioadmin or a key with WRITE permissions) can exploit these vulnerabilities to write arbitrary objects to any bucket within the MinIO deployment. This allows for data corruption, data exfiltration, and potentially the injection of malicious code. The lack of signature verification means that even without knowing the secret key, an attacker can successfully upload data. This bypass effectively negates the security controls designed to protect data at rest. The attack requires minimal effort, only a valid access key and a target bucket name, making it easily exploitable.

1. Reserved2026-04-10
2. Published2026-04-22
3. EPSS updated2026-04-29

The primary mitigation for CVE-2026-40344 is to immediately upgrade MinIO to version 2026-04-11T03-20-12Z or later. Prior to upgrading, assess the potential impact of the upgrade on existing applications and workflows. If a direct upgrade is not feasible due to compatibility issues, consider rolling back to a previous, known-good version if possible. While a direct fix is the recommended approach, restricting access key permissions to the minimum required scope can reduce the potential blast radius of a successful attack. Monitor MinIO logs for suspicious activity, particularly unauthorized object creation events. Consider implementing a Web Application Firewall (WAF) to filter requests and block attempts to exploit the vulnerability, although this is not a substitute for patching.