# MinIO vulnerabilities Source: https://junglewise.ai/threats/technologies/minio Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/minio.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in MinIO: 0 in the last 7 days and 3 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-122267, was published on 5 November 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 10 (2 critical, 2 exploited in the wild) ## About MinIO Open-source object storage server compatible with Amazon S3 API. ## Latest MinIO vulnerabilities - [CVE-2026-122267: MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25) (info, published 5 Nov 2026) - [CVE-2026-113466: MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-97731: MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header) (high, CVSS 7.1, published 25 Sep 2026) - [CVE-2026-42600: MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint) (medium, CVSS 4.9, published 11 May 2026) - [CVE-2026-41145: MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing](https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv) (high, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime](https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime) (high, CVSS 7.1, published 31 Mar 2026) - [CVE-2023-28434: Privilege Escalation on Linux/MacOS](https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Sep 2023) - [CVE-2023-28432: MinIO Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2023-28432-minio-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 21 Apr 2023) ## Most severe MinIO vulnerabilities - [CVE-2023-28432: MinIO Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2023-28432-minio-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 21 Apr 2023) - [CVE-2023-28434: Privilege Escalation on Linux/MacOS](https://junglewise.ai/threats/cve-2023-28434-minio-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Sep 2023) - [CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-40344-minio-has-an-unauthenticated-object-write-via-missing-signature) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-41145: MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string) (high, CVSS 8.2, published 22 Apr 2026) - [CVE-2026-34204: MinIO metadata injection in extractMetadataFromMime](https://junglewise.ai/threats/cve-2026-34204-minio-metadata-injection-in-extractmetadatafrommime) (high, CVSS 7.1, published 31 Mar 2026) - [CVE-2026-97731: MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header) (high, CVSS 7.1, published 25 Sep 2026) - [CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing](https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv) (high, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-113466: MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-42600: MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint) (medium, CVSS 4.9, published 11 May 2026) - [CVE-2026-122267: MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25) (info, published 5 Nov 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MinIO vulnerabilities", https://junglewise.ai/threats/technologies/minio, 13 November 2026.