MinIO SSE मेटाडेटा इंजेक्शन (SSE Metadata Injection) प्रतिकृति हेडर (Replication Headers) के माध्यम से github.com/minio/minio में असुरक्षित है

The SSE metadata injection vulnerability in MinIO allows an attacker to craft malicious replication headers that are processed by the server. This can lead to the injection of arbitrary metadata into objects stored within MinIO. Successful exploitation could result in data corruption, unauthorized modification of object properties, or even the creation of objects with misleading metadata. The impact is particularly concerning in environments where object metadata is used for access control, data validation, or other critical functions. While the immediate impact might be limited to a single object, a compromised MinIO instance could be leveraged to impact a wide range of applications and services relying on the storage.

Organizations heavily reliant on MinIO for object storage, particularly those using it for critical data or applications, are at risk. Environments with limited network segmentation or inadequate input validation practices are also more vulnerable. Any deployment using MinIO versions prior to RELEASE.2026-03-26T21-24-40Z should be considered at risk.

• go / server:

# Check MinIO version
minio version

• go / server:

# Monitor MinIO logs for unusual object creation/modification activity
journalctl -u minio -f | grep -i 'metadata injection'

• generic web:

# Check for unexpected metadata in object headers (requires MinIO client or API access)
minio ls --long <bucket>/<object>

1. 2026-03-27Disclosure

   disclosure

1. आरक्षित2026-03-26
2. प्रकाशित2026-03-27
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-04-08

The primary mitigation for CVE-2026-34204 is to upgrade to the patched version, RELEASE.2026-03-26T21-24-40Z. If an immediate upgrade is not feasible, consider implementing stricter input validation on replication headers at the network level, such as using a Web Application Firewall (WAF) or proxy server to filter out suspicious headers. Monitor MinIO logs for unusual activity related to object creation or modification. Specifically, look for unexpected metadata values or patterns. After upgrading, confirm the fix by attempting to replicate an object with a crafted header containing malicious metadata; the server should reject the request.