{"schema_version":1,"title":"github.com/minio/minio (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 15 vulnerabilities in github.com/minio/minio (Go): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-41145, was published on 25 June 2026.","url":"https://junglewise.ai/threats/technologies/github-com-minio-minio","json_url":"https://junglewise.ai/threats/technologies/github-com-minio-minio.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-minio-minio","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":15,"critical":1,"exploited":1,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":8},"latest":[{"cve":"CVE-2026-41145","cvss":3.1,"epss":0.006,"slug":"cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string","title":"GO-2026-5437 - MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2026-06-25T22:34:31+00:00","url":"https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string"},{"cve":"CVE-2026-40344","cvss":3.1,"epss":0.0072,"slug":"cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature","title":"GO-2026-5284 - MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2026-06-25T18:43:15+00:00","url":"https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature"},{"cve":"CVE-2026-42600","cvss":4.9,"epss":0.0047,"slug":"cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint","title":"MinIO path traversal in ReadMultiple storage-REST endpoint","severity":"medium","exploited":false,"published_at":"2026-05-11T22:22:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint"},{"cve":"CVE-2026-39414","cvss":6.5,"epss":0.0056,"slug":"cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv","title":"MinIO denial of service via memory exhaustion in S3 Select CSV parsing","severity":"high","exploited":false,"published_at":"2026-04-08T21:16:58.877+00:00","url":"https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv"},{"cve":"CVE-2026-34204","cvss":7.1,"epss":0.0021,"slug":"cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime","title":"MinIO metadata injection in extractMetadataFromMime","severity":"high","exploited":false,"published_at":"2026-03-31T20:16:28.583+00:00","url":"https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime"},{"cve":"CVE-2026-33419","cvss":4,"epss":0.0054,"slug":"cve-2026-33419-minio-ldap-login-brute-force-via-user-enumeration-and-missing","title":"GO-2026-4803 - MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2026-03-23T18:16:18+00:00","url":"https://junglewise.ai/threats/cve-2026-33419-minio-ldap-login-brute-force-via-user-enumeration-and-missing"},{"cve":"CVE-2026-33322","cvss":4,"epss":0.0061,"slug":"cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication","title":"GO-2026-4779 - MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2026-03-23T18:16:14+00:00","url":"https://junglewise.ai/threats/cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication"},{"cve":"CVE-2025-62506","cvss":3.1,"epss":0.0055,"slug":"cve-2025-62506-minio-is-vulnerable-to-privilege-escalation-via-session-policy","title":"GO-2025-4034 - MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2025-10-30T15:02:33+00:00","url":"https://junglewise.ai/threats/cve-2025-62506-minio-is-vulnerable-to-privilege-escalation-via-session-policy"},{"cve":"CVE-2025-31489","cvss":4,"epss":0.0243,"slug":"cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned","title":"GO-2025-3594 - MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2025-04-09T17:05:36+00:00","url":"https://junglewise.ai/threats/cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned"},{"cve":"CVE-2025-27414","cvss":4,"epss":0.0059,"slug":"cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly","title":"GO-2025-3495 - MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2025-03-03T19:22:09+00:00","url":"https://junglewise.ai/threats/cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly"},{"cve":"CVE-2024-55949","cvss":4,"epss":0.0071,"slug":"cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api","title":"GO-2024-3336 - MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2024-12-18T16:35:54+00:00","url":"https://junglewise.ai/threats/cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api"},{"cve":"CVE-2024-24747","cvss":3.1,"epss":0.3409,"slug":"cve-2024-24747-minio-unsafe-default-access-keys-inherit-admin-of-root-user","title":"GO-2024-2499 - Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2024-06-28T15:28:53+00:00","url":"https://junglewise.ai/threats/cve-2024-24747-minio-unsafe-default-access-keys-inherit-admin-of-root-user"},{"cve":"CVE-2024-36107","cvss":3.1,"epss":0.0063,"slug":"cve-2024-36107-minio-information-disclosure-vulnerability","title":"GO-2024-2886 - MinIO information disclosure vulnerability in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2024-06-05T15:10:42+00:00","url":"https://junglewise.ai/threats/cve-2024-36107-minio-information-disclosure-vulnerability"},{"cve":"CVE-2023-28433","cvss":3.1,"epss":0.0098,"slug":"cve-2023-28433-minio-vulnerable-to-privilege-escalation-on-windows-via-path","title":"Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation","severity":"low","exploited":false,"published_at":"2023-09-06T18:43:13+00:00","url":"https://junglewise.ai/threats/cve-2023-28433-minio-vulnerable-to-privilege-escalation-on-windows-via-path"},{"cve":"CVE-2023-28434","cvss":3.1,"epss":0.0792,"slug":"cve-2023-28434-minio-security-feature-bypass-vulnerability","title":"Privilege Escalation on Linux/MacOS","severity":"critical","exploited":true,"published_at":"2023-09-05T15:45:10+00:00","url":"https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":274,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":188,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":186,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":182,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":158,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":128,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik/v3 (Go)","slug":"github-com-traefik-traefik-v3","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3"}],"technology":{"hub":true,"name":"github.com/minio/minio (Go)","slug":"github-com-minio-minio","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://min.io/","repo_url":"https://github.com/minio/minio","description":"A high-performance, S3-compatible object storage server written in Go.","url":"https://junglewise.ai/threats/technologies/github-com-minio-minio"},"most_severe":[{"cve":"CVE-2023-28434","cvss":3.1,"epss":0.0792,"slug":"cve-2023-28434-minio-security-feature-bypass-vulnerability","title":"Privilege Escalation on Linux/MacOS","severity":"critical","exploited":true,"published_at":"2023-09-05T15:45:10+00:00","url":"https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability"},{"cve":"CVE-2026-34204","cvss":7.1,"epss":0.0021,"slug":"cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime","title":"MinIO metadata injection in extractMetadataFromMime","severity":"high","exploited":false,"published_at":"2026-03-31T20:16:28.583+00:00","url":"https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime"},{"cve":"CVE-2026-39414","cvss":6.5,"epss":0.0056,"slug":"cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv","title":"MinIO denial of service via memory exhaustion in S3 Select CSV parsing","severity":"high","exploited":false,"published_at":"2026-04-08T21:16:58.877+00:00","url":"https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv"},{"cve":"CVE-2026-42600","cvss":4.9,"epss":0.0047,"slug":"cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint","title":"MinIO path traversal in ReadMultiple storage-REST endpoint","severity":"medium","exploited":false,"published_at":"2026-05-11T22:22:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint"},{"cve":"CVE-2025-31489","cvss":4,"epss":0.0243,"slug":"cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned","title":"GO-2025-3594 - MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2025-04-09T17:05:36+00:00","url":"https://junglewise.ai/threats/cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned"},{"cve":"CVE-2024-55949","cvss":4,"epss":0.0071,"slug":"cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api","title":"GO-2024-3336 - MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2024-12-18T16:35:54+00:00","url":"https://junglewise.ai/threats/cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api"},{"cve":"CVE-2026-33322","cvss":4,"epss":0.0061,"slug":"cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication","title":"GO-2026-4779 - MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2026-03-23T18:16:14+00:00","url":"https://junglewise.ai/threats/cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication"},{"cve":"CVE-2025-27414","cvss":4,"epss":0.0059,"slug":"cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly","title":"GO-2025-3495 - MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2025-03-03T19:22:09+00:00","url":"https://junglewise.ai/threats/cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly"},{"cve":"CVE-2026-33419","cvss":4,"epss":0.0054,"slug":"cve-2026-33419-minio-ldap-login-brute-force-via-user-enumeration-and-missing","title":"GO-2026-4803 - MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio","severity":"medium","exploited":false,"published_at":"2026-03-23T18:16:18+00:00","url":"https://junglewise.ai/threats/cve-2026-33419-minio-ldap-login-brute-force-via-user-enumeration-and-missing"},{"cve":"CVE-2024-24747","cvss":3.1,"epss":0.3409,"slug":"cve-2024-24747-minio-unsafe-default-access-keys-inherit-admin-of-root-user","title":"GO-2024-2499 - Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio","severity":"low","exploited":false,"published_at":"2024-06-28T15:28:53+00:00","url":"https://junglewise.ai/threats/cve-2024-24747-minio-unsafe-default-access-keys-inherit-admin-of-root-user"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}