Vulnerabilidades em minio
32 resultadosAnálise Vexday
MinIO apresenta 30 vulnerabilidades conhecidas com 2 sob ataque ativo confirmado, concentrando risco moderado. Das 3 críticas identificadas, a fraqueza dominante é CWE-269 (elevação de privilégio imprópria), com atividade recente de 3 publicações nos últimos 90 dias indicando código evolua rapidamente. Organizações usando MinIO devem priorizar patches para os 2 CVEs em exploração ativa e revisar controles de acesso.
CVE-2024-36107MEDIUMInformation disclosure in minioEPSS 0.6%CVE-2025-32963MEDIUMMinio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STSEPSS 0.6%CVE-2026-33322CRITICALMinIO: JWT Algorithm Confusion in OIDC AuthenticationEPSS 0.6%CVE-2026-41145HIGHMinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer UploadsEPSS 0.6%CVE-2025-27414MEDIUMMinIO SFTP authentication bypass due to improperly trusted SSH keyEPSS 0.6%CVE-2026-39414HIGHMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingEPSS 0.6%CVE-2025-62506HIGHMinIO vulnerable to privilege escalation via session policy bypass in service accounts and STSEPSS 0.6%CVE-2026-33419CRITICALMinIO: LDAP login brute-force via user enumeration and missing rate limitEPSS 0.5%CVE-2025-59952HIGHminio-java Client XML Tag is Vulnerable to Value SubstitutionEPSS 0.5%CVE-2026-42600MEDIUMMinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointEPSS 0.5%CVE-2026-34204HIGHMinIO is Vulnerable to SSE Metadata Injection via Replication HeadersEPSS 0.2%CVE-2026-97731HIGHMinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeadersEPSS 0.2%