# github.com/minio/minio (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-minio-minio Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-minio-minio.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in github.com/minio/minio (Go): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-42600, was published on 11 May 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 15 (1 critical, 1 exploited in the wild) ## About github.com/minio/minio (Go) Go implementation of an S3-compatible object storage server. ## Latest github.com/minio/minio (Go) vulnerabilities - [CVE-2026-42600: MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint) (medium, CVSS 4.9, published 11 May 2026) - [CVE-2026-41145: MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing](https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv) (high, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime](https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime) (high, CVSS 7.1, published 31 Mar 2026) - [CVE-2026-33419: GO-2026-4803 - MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio](https://junglewise.ai/threats/cve-2026-33419-minio-ldap-login-brute-force-via-user-enumeration-and-missing) (medium, CVSS 4, published 23 Mar 2026) - [CVE-2026-33322: GO-2026-4779 - MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio](https://junglewise.ai/threats/cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication) (medium, CVSS 4, published 23 Mar 2026) - [CVE-2025-62506: MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS](https://junglewise.ai/threats/cve-2025-62506-minio-is-vulnerable-to-privilege-escalation-via-session-policy) (low, CVSS 3.1, published 30 Oct 2025) - [CVE-2025-31489: GO-2025-3594 - MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio](https://junglewise.ai/threats/cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned) (medium, CVSS 4, published 9 Apr 2025) - [CVE-2025-27414: GO-2025-3495 - MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio](https://junglewise.ai/threats/cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly) (medium, CVSS 4, published 3 Mar 2025) - [CVE-2024-55949: GO-2024-3336 - MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio](https://junglewise.ai/threats/cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api) (medium, CVSS 4, published 18 Dec 2024) - [CVE-2024-24747: Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation](https://junglewise.ai/threats/cve-2024-24747-minio-unsafe-default-access-keys-inherit-admin-of-root-user) (low, CVSS 3.1, published 28 Jun 2024) - [CVE-2024-36107: GO-2024-2886 - MinIO information disclosure vulnerability in github.com/minio/minio](https://junglewise.ai/threats/cve-2024-36107-minio-information-disclosure-vulnerability) (low, CVSS 3.1, published 5 Jun 2024) - [CVE-2023-28433: Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation](https://junglewise.ai/threats/cve-2023-28433-minio-vulnerable-to-privilege-escalation-on-windows-via-path) (low, CVSS 3.1, published 6 Sep 2023) - [CVE-2023-28434: Privilege Escalation on Linux/MacOS](https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Sep 2023) ## Most severe github.com/minio/minio (Go) vulnerabilities - [CVE-2023-28434: Privilege Escalation on Linux/MacOS](https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Sep 2023) - [CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-41145: MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime](https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime) (high, CVSS 7.1, published 31 Mar 2026) - [CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing](https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv) (high, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-42600: MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint) (medium, CVSS 4.9, published 11 May 2026) - [CVE-2025-31489: GO-2025-3594 - MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio](https://junglewise.ai/threats/cve-2025-31489-minio-performs-incomplete-signature-validation-for-unsigned) (medium, CVSS 4, published 9 Apr 2025) - [CVE-2024-55949: GO-2024-3336 - MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio](https://junglewise.ai/threats/cve-2024-55949-minio-vulnerable-to-privilege-escalation-in-iam-import-api) (medium, CVSS 4, published 18 Dec 2024) - [CVE-2026-33322: GO-2026-4779 - MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio](https://junglewise.ai/threats/cve-2026-33322-minio-has-jwt-algorithm-confusion-in-oidc-authentication) (medium, CVSS 4, published 23 Mar 2026) - [CVE-2025-27414: GO-2025-3495 - MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio](https://junglewise.ai/threats/cve-2025-27414-minio-allows-an-sftp-authentication-bypass-due-to-improperly) (medium, CVSS 4, published 3 Mar 2025) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/minio/minio (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-minio-minio, 13 November 2026.