CVE-2026-42600: MinIO path traversal in ReadMultiple storage-REST endpoint

CVE-2026-42600 · Severity: medium · CVSS 4.9 · Published 2026-05-11

MinIO, a high-performance object storage service, is vulnerable to a security flaw in its internal communication system. An attacker with administrative credentials can bypass security restrictions to read sensitive files directly from the server's underlying operating system. This could lead to the exposure of private encryption keys, system passwords, and other confidential data, potentially allowing for a full compromise of the host environment.

Technologies: github.com/minio/minio (Go), Minio. Vendors: Go, MinIO.

Quick answers

Is CVE-2026-42600 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42600 being exploited in the wild.
How severe is CVE-2026-42600?
Medium severity, with a CVSS score of 4.9, published 11 May 2026.
Which products and versions are affected?
github.com/minio/minio (Go) >= 0.0.0-20220724015452, < 0.0.0-20260414213245, SEMVER:introduced=0, SEMVER:introduced=0.0.0-20220724015452,fixed=0.0.0-20260414213245; Minio RELEASE.2022-07-24T01-54-52Z through RELEASE.2025-09-07T16-13-09Z, RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z.
Is there a fix for CVE-2026-42600?
Yes. github.com/minio/minio (Go): upgrade to 0.0.0-20260414213245 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42600 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42600?
Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/minio/minio (Go): upgrade to 0.0.0-20260414213245 or later
    go get github.com/minio/minio@v0.0.0-20260414213245

Technical details

A path traversal vulnerability exists in MinIO's `ReadMultiple` internode storage-REST endpoint due to insufficient validation of the `Bucket` field in msgpack-encoded request bodies. While global middleware filters `..` sequences in URL paths and forms, it does not inspect the msgpack body processed by `cmd/storage-rest-server.go`. An attacker possessing the cluster root JWT (signed with `MINIO_ROOT_PASSWORD`) can use `..` sequences to escape the drive root. The server uses `os.OpenFile` with `O_RDONLY|O_NOATIME` to return file contents. Impact varies by deployment: bare-metal installations are limited to files owned by the MinIO UID, while containerized deployments running as root (UID 0) allow full host filesystem disclosure. The vulnerability was fixed by removing the affected handler in MinIO AIStor RELEASE.2024-10-23T19-38-07Z.

Affected products

  • MinIO MinIO RELEASE.2022-07-24T01-54-52Z through RELEASE.2025-09-07T16-13-09Z

Identifiers

  • CVE-2026-42600
  • GHSA-xh8f-g2qw-gcm7
  • GO-2026-5757

Timeline

  • 2022-07-24: other: Vulnerability introduced in RELEASE.2022-07-24T01-54-52Z
  • 2024-10-23: patched: First patched in MinIO AIStor RELEASE.2024-10-23T19-38-07Z
  • 2026-04-25: disclosed
  • 2026-05-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.