# CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime

Source: https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34204 · Severity: high · CVSS 7.1 · Published 2026-03-31

MinIO is a high-performance object storage system used to store and manage large amounts of data. A security flaw allows any user with basic upload permissions to inject fake encryption settings into files, making those files permanently unreadable. This can lead to a targeted denial-of-service where an attacker destroys the accessibility of data within the storage system.

Technologies: [github.com/minio/minio (Go)](https://junglewise.ai/threats/technologies/github-com-minio-minio), [Minio](https://junglewise.ai/threats/technologies/minio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [MinIO](https://junglewise.ai/threats/vendors/minio).

## Quick answers

**Is CVE-2026-34204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34204 being exploited in the wild.

**How severe is CVE-2026-34204?** High severity, with a CVSS score of 7.1, published 31 March 2026.

**Which products and versions are affected?** github.com/minio/minio (Go) SEMVER:introduced=0.0.0-20240328174456-468a9fae83e9, SEMVER:introduced=0.0.0-20240328174456-468a9fae83e9,last_affected=0.0.0-20260212201848-7aac2a2c5b7c; Minio RELEASE.2024-03-30T09-41-56Z to RELEASE.2026-03-26T21-24-40Z.

**Is there a fix for CVE-2026-34204?** A patch was published on 2026-03-26: Fixed in RELEASE.2026-03-26T21-24-40Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34204 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-34204?** Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw exists in the extractMetadataFromMime() function within cmd/handler-utils.go. The server unconditionally maps X-Minio-Replication-* headers to internal X-Minio-Internal-* encryption metadata without verifying if the request is a legitimate replication request (missing X-Minio-Source-Replication-Request header). An authenticated attacker with s3:PutObject permissions can send crafted replication headers during a standard upload. This causes the server to treat the object as encrypted with non-existent keys, resulting in permanent data loss for that object as subsequent GetObject or HeadObject calls will fail. The issue is patched in version RELEASE.2026-03-26T21-24-40Z.

## Affected products

- MinIO MinIO RELEASE.2024-03-30T09-41-56Z to RELEASE.2026-03-26T21-24-40Z

## Identifiers

- CVE-2026-34204
- GHSA-3rh2-v3gr-35p9
- GO-2026-4896

## Timeline

- 2024-03-28: other: Vulnerability introduced in commit 468a9fae8
- 2026-03-27: advisory: GitHub advisory GHSA-3rh2-v3gr-35p9 published
- 2026-03-26: patched: Fixed in RELEASE.2026-03-26T21-24-40Z
- 2026-03-31: disclosed: CVE-2026-34204 published to NVD

## References

- [https://github.com/minio/minio/security/advisories/GHSA-3rh2-v3gr-35p9](https://github.com/minio/minio/security/advisories/GHSA-3rh2-v3gr-35p9)

## Related threats

- [MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25)
- [MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to)
- [MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header)
- [MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint)
- [MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string)