# CVE-2026-122267: MinIO Signature V4 verification improper signature validation

Source: https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-122267 · Severity: info · Published 2026-11-05

MinIO, an object storage system compatible with Amazon S3, fails to validate certain request headers in its signature verification process. An attacker with a presigned URL limited to uploading a single object could add unsigned headers to read any object from any bucket that the signing credentials can access, turning a write-only permission into cross-bucket read access.

Technologies: [Minio](https://junglewise.ai/threats/technologies/minio). Vendors: [MinIO](https://junglewise.ai/threats/vendors/minio).

## Quick answers

**Is CVE-2026-122267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122267 being exploited in the wild.

**How severe is CVE-2026-122267?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Minio before RELEASE.2026-09-22T19-25-18Z.

**Is there a fix for CVE-2026-122267?** Yes: fixed in RELEASE.2026-09-22T19-25-18Z. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122267 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-122267?** Check whether you run Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in RELEASE.2026-09-22T19-25-18Z

## Technical details

The vulnerability exists in Signature V4 verification, specifically in the extractSignedHeaders function, which only validates headers listed in the SignedHeaders field and ignores unsigned x-amz-* headers present in the actual request. An attacker can exploit this by appending x-amz-copy-source or other steering headers to a presigned PUT request to bypass intended scope restrictions. The router dispatches PUT requests with x-amz-copy-source to CopyObjectHandler based on the header alone, allowing server-side copy operations as the signing key.

## Affected products

- MinIO MinIO before RELEASE.2026-09-22T19-25-18Z

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg](https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg)

## Related threats

- [MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to)
- [MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header)
- [MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint)
- [MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string)
- [MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature)