Executive brief
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio
Affected products
- Go github.com/minio/minio
Junglewise Threat Intelligence
CVE-2026-41145: GO-2026-5437 - MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio
CVE-2026-41145 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/minio/minio (Go). Vendors: Go.
Related threats
- GO-2026-5284 - MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio
- MinIO path traversal in ReadMultiple storage-REST endpoint
- MinIO denial of service via memory exhaustion in S3 Select CSV parsing
- MinIO metadata injection in extractMetadataFromMime
- GO-2026-4803 - MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio