CVE-2021-43858highCWE-269

CVE-2021-43858: high-severity vulnerability in minio

User privilege escalation in MinIO

Published · Updated

Follow this CVE+ Monitor minio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 35%
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
minio · minio
Related CVEs — minio

In the same product, most dangerous first.

CVE-2023-28432HIGHMinio Information Disclosure in Cluster DeploymentEPSS 84.0%KEVCVE-2023-28434HIGHMinIO is vulnerable to privilege escalation on Linux/MacOSEPSS 7.9%KEVCVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2024-24747HIGHMinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationEPSS 34.1%CVE-2021-21287HIGHServer-Side Request Forgery in MinIO Browser APIEPSS 23.9%CVE-2026-42600MEDIUMMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointEPSS 8.7%