Actively exploited in the wild
MinIO Security Feature Bypass Vulnerability
MinIO - MinIO · Listed in the CISA KEV since 2023-09-19. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-28434
HighCVSS 8.8KEVSummary
Minio to framework do przechowywania obiektów w chmurze. Przed wersją RELEASE.2023-03-20T20-16-18Z, atakujący mógł wykorzystać spreparowane żądania do ominięcia sprawdzania nazwy koszyka metadanych i umieścić obiekt w dowolnym koszyku podczas przetwarzania `PostPolicyBucket`.
Risk Assessment
Atakujący z odpowiednimi uprawnieniami może manipulować danymi w systemie, co prowadzi do potencjalnej utraty integralności danych oraz naruszenia bezpieczeństwa przechowywanych obiektów.
Recommendation
Zaleca się aktualizację do wersji RELEASE.2023-03-20T20-16-18Z. Jako tymczasowe rozwiązanie, włącz dostęp do API przeglądarki i wyłącz `MINIO_BROWSER=off`.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.