CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime

CVE-2026-34204 · Severity: high · CVSS 7.1 · Published 2026-03-31

MinIO is a high-performance object storage system used to store and manage large amounts of data. A security flaw allows any user with basic upload permissions to inject fake encryption settings into files, making those files permanently unreadable. This can lead to a targeted denial-of-service where an attacker destroys the accessibility of data within the storage system.

Technologies: github.com/minio/minio (Go), Minio. Vendors: Go, MinIO.

Quick answers

Is CVE-2026-34204 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34204 being exploited in the wild.
How severe is CVE-2026-34204?
High severity, with a CVSS score of 7.1, published 31 March 2026.
Which products and versions are affected?
github.com/minio/minio (Go) SEMVER:introduced=0.0.0-20240328174456-468a9fae83e9, SEMVER:introduced=0.0.0-20240328174456-468a9fae83e9,last_affected=0.0.0-20260212201848-7aac2a2c5b7c; Minio RELEASE.2024-03-30T09-41-56Z to RELEASE.2026-03-26T21-24-40Z.
Is there a fix for CVE-2026-34204?
A patch was published on 2026-03-26: Fixed in RELEASE.2026-03-26T21-24-40Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34204 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34204?
Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in the extractMetadataFromMime() function within cmd/handler-utils.go. The server unconditionally maps X-Minio-Replication-* headers to internal X-Minio-Internal-* encryption metadata without verifying if the request is a legitimate replication request (missing X-Minio-Source-Replication-Request header). An authenticated attacker with s3:PutObject permissions can send crafted replication headers during a standard upload. This causes the server to treat the object as encrypted with non-existent keys, resulting in permanent data loss for that object as subsequent GetObject or HeadObject calls will fail. The issue is patched in version RELEASE.2026-03-26T21-24-40Z.

Affected products

  • MinIO MinIO RELEASE.2024-03-30T09-41-56Z to RELEASE.2026-03-26T21-24-40Z

Identifiers

  • CVE-2026-34204
  • GHSA-3rh2-v3gr-35p9
  • GO-2026-4896

Timeline

  • 2024-03-28: other: Vulnerability introduced in commit 468a9fae8
  • 2026-03-27: advisory: GitHub advisory GHSA-3rh2-v3gr-35p9 published
  • 2026-03-26: patched: Fixed in RELEASE.2026-03-26T21-24-40Z
  • 2026-03-31: disclosed: CVE-2026-34204 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.