Is CVE-2026-97731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97731 being exploited in the wild.

How severe is CVE-2026-97731?

High severity, with a CVSS score of 7.1, published 25 September 2026.

Which products and versions are affected?

Minio through 7aac2a2; PGSTY Silo before 1233254.

Is there a fix for CVE-2026-97731?

A patch was published on 2026-09-10: pgsty/silo commit 1233254 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97731 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-97731?

Check whether you run Minio or PGSTY Silo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97731: MinIO signature verification bypass in SigV4 header validation

CVE-2026-97731 · Severity: high · CVSS 7.1 · Published 2026-09-25

MinIO's S3-compatible object storage fails to validate that all x-amz-* headers in a request are listed in the signed headers. An attacker with a presigned or signed URL for a PUT operation on a single object can inject an unsigned x-amz-copy-source header to trigger a server-side copy of any object readable by the signing key, effectively escalating write access on one object to read access across all buckets the key can reach.

Technologies: Minio. Vendors: MinIO.

Quick answers

Is CVE-2026-97731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97731 being exploited in the wild.
How severe is CVE-2026-97731?: High severity, with a CVSS score of 7.1, published 25 September 2026.
Which products and versions are affected?: Minio through 7aac2a2; PGSTY Silo before 1233254.
Is there a fix for CVE-2026-97731?: A patch was published on 2026-09-10: pgsty/silo commit 1233254 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97731 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-97731?: Check whether you run Minio or PGSTY Silo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SigV4 signature verification in cmd/signature-v4-utils.go only validates headers that appear in the client-supplied X-Amz-SignedHeaders list and never enumerates headers actually received in the request. An unsigned x-amz-* header bypasses both hashing into the canonical request and rejection. The cmd/api-router.go dispatches CopyObject operations based solely on the presence of the x-amz-copy-source header, allowing an attacker to transform a single-object PUT authorization into arbitrary object copies executed as the signer. AWS S3 correctly rejects such requests with HTTP 403 AccessDenied.

Affected products

MinIO MinIO through 7aac2a2
PGSTY Silo before 1233254

Timeline

2026-09-25: disclosed
2026-09-10: patched: pgsty/silo commit 1233254

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.