{"schema_version":1,"title":"MinIO vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in MinIO: 1 in the last 7 days and 1 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-97731, was published on 25 September 2026.","url":"https://junglewise.ai/threats/technologies/minio","json_url":"https://junglewise.ai/threats/technologies/minio.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/minio","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":6,"critical":2,"exploited":2,"last_7_days":1,"last_30_days":1,"last_90_days":1,"last_365_days":4},"latest":[{"cve":"CVE-2026-97731","cvss":7.1,"epss":0.0015,"slug":"cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header","title":"MinIO signature verification bypass in SigV4 header validation","severity":"high","exploited":false,"published_at":"2026-09-25T03:16:59.697+00:00","url":"https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header"},{"cve":"CVE-2026-42600","cvss":4.9,"epss":0.0047,"slug":"cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint","title":"MinIO path traversal in ReadMultiple storage-REST endpoint","severity":"medium","exploited":false,"published_at":"2026-05-11T22:22:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint"},{"cve":"CVE-2026-39414","cvss":6.5,"epss":0.0056,"slug":"cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv","title":"MinIO denial of service via memory exhaustion in S3 Select CSV parsing","severity":"high","exploited":false,"published_at":"2026-04-08T21:16:58.877+00:00","url":"https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv"},{"cve":"CVE-2026-34204","cvss":7.1,"epss":0.0021,"slug":"cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime","title":"MinIO metadata injection in extractMetadataFromMime","severity":"high","exploited":false,"published_at":"2026-03-31T20:16:28.583+00:00","url":"https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime"},{"cve":"CVE-2023-28434","cvss":3.1,"epss":0.0792,"slug":"cve-2023-28434-minio-security-feature-bypass-vulnerability","title":"Privilege Escalation on Linux/MacOS","severity":"critical","exploited":true,"published_at":"2023-09-05T15:45:10+00:00","url":"https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability"},{"cve":"CVE-2023-28432","cvss":7.5,"slug":"cve-2023-28432-minio-information-disclosure-vulnerability","title":"MinIO Information Disclosure Vulnerability","severity":"critical","exploited":true,"published_at":"2023-04-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-28432-minio-information-disclosure-vulnerability"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[],"technology":{"hub":true,"name":"MinIO","slug":"minio","vendor":{"name":"MinIO","slug":"minio","url":"https://junglewise.ai/threats/vendors/minio"},"aliases":[],"category":"storage-server","homepage":"https://min.io/","repo_url":"https://github.com/minio/minio","description":"MinIO is a high-performance, S3-compatible object storage server designed for cloud-native workloads.","url":"https://junglewise.ai/threats/technologies/minio"},"most_severe":[{"cve":"CVE-2023-28432","cvss":7.5,"slug":"cve-2023-28432-minio-information-disclosure-vulnerability","title":"MinIO Information Disclosure Vulnerability","severity":"critical","exploited":true,"published_at":"2023-04-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-28432-minio-information-disclosure-vulnerability"},{"cve":"CVE-2023-28434","cvss":3.1,"epss":0.0792,"slug":"cve-2023-28434-minio-security-feature-bypass-vulnerability","title":"Privilege Escalation on Linux/MacOS","severity":"critical","exploited":true,"published_at":"2023-09-05T15:45:10+00:00","url":"https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability"},{"cve":"CVE-2026-34204","cvss":7.1,"epss":0.0021,"slug":"cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime","title":"MinIO metadata injection in extractMetadataFromMime","severity":"high","exploited":false,"published_at":"2026-03-31T20:16:28.583+00:00","url":"https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime"},{"cve":"CVE-2026-97731","cvss":7.1,"epss":0.0015,"slug":"cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header","title":"MinIO signature verification bypass in SigV4 header validation","severity":"high","exploited":false,"published_at":"2026-09-25T03:16:59.697+00:00","url":"https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header"},{"cve":"CVE-2026-39414","cvss":6.5,"epss":0.0056,"slug":"cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv","title":"MinIO denial of service via memory exhaustion in S3 Select CSV parsing","severity":"high","exploited":false,"published_at":"2026-04-08T21:16:58.877+00:00","url":"https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv"},{"cve":"CVE-2026-42600","cvss":4.9,"epss":0.0047,"slug":"cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint","title":"MinIO path traversal in ReadMultiple storage-REST endpoint","severity":"medium","exploited":false,"published_at":"2026-05-11T22:22:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint"}],"generated_at":"2026-09-26T16:07:00.132667+00:00"}