# CVE-2026-97731: MinIO signature verification bypass in SigV4 header validation

Source: https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97731 · Severity: high · CVSS 7.1 · Published 2026-09-25

MinIO's S3-compatible object storage fails to validate that all x-amz-* headers in a request are listed in the signed headers. An attacker with a presigned or signed URL for a PUT operation on a single object can inject an unsigned x-amz-copy-source header to trigger a server-side copy of any object readable by the signing key, effectively escalating write access on one object to read access across all buckets the key can reach.

Technologies: [Minio](https://junglewise.ai/threats/technologies/minio). Vendors: [MinIO](https://junglewise.ai/threats/vendors/minio).

## Quick answers

**Is CVE-2026-97731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97731 being exploited in the wild.

**How severe is CVE-2026-97731?** High severity, with a CVSS score of 7.1, published 25 September 2026.

**Which products and versions are affected?** Minio through 7aac2a2; PGSTY Silo before 1233254.

**Is there a fix for CVE-2026-97731?** A patch was published on 2026-09-10: pgsty/silo commit 1233254 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97731 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-97731?** Check whether you run Minio or PGSTY Silo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SigV4 signature verification in cmd/signature-v4-utils.go only validates headers that appear in the client-supplied X-Amz-SignedHeaders list and never enumerates headers actually received in the request. An unsigned x-amz-* header bypasses both hashing into the canonical request and rejection. The cmd/api-router.go dispatches CopyObject operations based solely on the presence of the x-amz-copy-source header, allowing an attacker to transform a single-object PUT authorization into arbitrary object copies executed as the signer. AWS S3 correctly rejects such requests with HTTP 403 AccessDenied.

## Affected products

- MinIO MinIO through 7aac2a2
- PGSTY Silo before 1233254

## Timeline

- 2026-09-25: disclosed
- 2026-09-10: patched: pgsty/silo commit 1233254

## References

- [https://github.com/pgsty/silo/commit/1233254309b15571f101b2b26d531951ceaeef1e](https://github.com/pgsty/silo/commit/1233254309b15571f101b2b26d531951ceaeef1e)
- [https://silo.pgsty.com/about/security-advisories/](https://silo.pgsty.com/about/security-advisories/)

## Related threats

- [MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25)
- [MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to)
- [MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint)
- [MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string)
- [MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature)