# CVE-2023-28432: MinIO Information Disclosure Vulnerability

Source: https://junglewise.ai/threats/cve-2023-28432-minio-information-disclosure-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-04-21. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2023-28432 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2023-04-21

MinIO cluster deployments contain an information disclosure vulnerability where the application returns all environment variables. This includes sensitive credentials such as MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, potentially allowing unauthorized actors to gain full administrative access.

Technologies: [Minio](https://junglewise.ai/threats/technologies/minio). Vendors: [MinIO](https://junglewise.ai/threats/vendors/minio).

## Quick answers

**Is CVE-2023-28432 exploited in the wild?** Yes. CVE-2023-28432 is known to be exploited in the wild, first recorded on 21 April 2023. Treat it as urgent.

**How severe is CVE-2023-28432?** Critical severity, with a CVSS score of 7.5, published 21 April 2023.

**Which products and versions are affected?** MinIO MinIO RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z (exclusive).

**Is there a fix for CVE-2023-28432?** A patch was published on 2023-03-20: Fixed in RELEASE.2023-03-20T20-16-18Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-28432 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2023-28432?** Check whether you run Minio. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- MinIO MinIO RELEASE.2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z (exclusive)

## Timeline

- 2023-03-20: patched: Fixed in RELEASE.2023-03-20T20-16-18Z
- 2023-04-21: disclosed: Published to NVD
- 2023-04-21: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2023-04-21: exploited: Reported as exploited in the wild by CISA and third-party researchers.

## Related threats

- [MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25)
- [MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to)
- [MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header)
- [MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint)
- [MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string)