Security Advisories

This ledger summarizes fork-specific security fixes and closely related upgrade-impacting security notes in pgsty/silo. It is intentionally narrower than a changelog and focuses on release-impacting security behavior. Each advisory with its own investigation also has an article in the Security Chronicle; this page is the stable index of identifiers, fixes, and release boundaries.

Entries carry a CVE identifier where one exists. Where none does, they carry a fork-local SN-<year>-<sequence> identifier so that a finding without a CVE can still be referenced stably from release notes, commits and issues. An SN- identifier is not a CVE and is not registered in any vulnerability database; it is deliberately not written in CVE form so that scanners do not mistake it for one. Upstream minio/minio is archived, so for findings in inherited code there is no upstream maintainer to coordinate a CVE assignment with. SN-2026-001 is the streaming-flush regression in trackingResponseWriter, which is a reliability defect rather than a security one and is tracked in the release notes rather than here.

Current release boundary

Verified 2026-09-16. The latest published Server is RELEASE.2026-09-03T13-18-01Z. SN-2026-011 is fixed on main but remains present in that release and all earlier public Server releases. A newer mcli, pkg or standalone Console does not patch an installed Server. See the component matrix for source pins.

Server 20260903 also lacks SN-2026-012 and SN-2026-013. The standalone Console boundary differs: SN-2026-014 is fixed in released Console v2.4.1, while an embedded Console requires a repaired Server build.

Inherited upstream advisory baseline

The first Silo community release was cut from upstream history that already contained the following security fix. Upstream and Silo links are both recorded even when the fork preserves the same commit object and SHA; that identity is the inheritance evidence, not a claim that Silo independently reimplemented the patch.

Advisories since RELEASE.2026-03-21T00-00-00Z

Upgrade and compatibility notes for each entry follow. Entries whose full investigation is told in a chronicle article are summarized here; follow the link for the threat model, rejected alternatives, and verification.

CVE-2026-33322 — OIDC STS JWT algorithm confusion

Remote exploitation: yes. Closes JWT algorithm confusion by removing HMAC/shared-secret verification and requiring JWKS-backed verifier keys. Breaking change: providers issuing HS256, HS384, or HS512 tokens for these STS flows must switch to JWKS-backed RSA or ECDSA signing before upgrading. PS256 and EdDSA are not currently supported.

CVE-2026-33419 — LDAP STS username enumeration

Remote exploitation: yes. Prevents username enumeration by unifying unknown-user and bad-password responses (both now 400 InvalidParameterValue) and adds in-memory login throttling. The final June design limits by source IP only; it removed the shared username bucket because attackers could use it to lock out a specific account. Limits are per-node and in-memory; the source address trust policy is configurable separately. See the LDAP STS chronicle for the successive repairs.

CVE-2026-34204 — replication metadata injection

Remote exploitation: yes. Blocks untrusted X-Minio-Replication-* headers from being smuggled into internal replication metadata and leaving objects unreadable. Upgrade any server that accepts untrusted PutObject or CopyObject requests, which in practice means almost any production server that accepts writes.

CVE-2026-39414 — S3 Select oversized records

Remote exploitation: yes. Rejects oversized CSV and line-delimited JSON records with OverMaxRecordSize instead of buffering them unchecked. The April fix initially missed the SIMD JSON path; the June follow-up routes all JSON Lines through the bounded json.PReader, closing that bypass. See the S3 Select chronicle.

CVE-2026-41145 — unsigned-trailer authentication bypass

Remote exploitation: yes. Closes the query-string authentication bypass in unsigned-trailer streaming requests. Upgrade if clients can reach object write endpoints using the STREAMING-UNSIGNED-PAYLOAD-TRAILER content-sha256 mode together with query-string SigV4 credentials.

CVE-2026-40344 — Snowball auto-extract authentication

Remote exploitation: yes. Verifies request authentication before tar extraction in Snowball unsigned-trailer flows. Upgrade if you use PutObjectExtract or Snowball uploads.

CVE-2026-42600 — internode ReadMultiple path traversal

Remote exploitation: yes; cluster-root JWT required. Removes the unused endpoint that allowed path traversal outside configured drive roots. Upgrade distributed-erasure deployments. Single-node deployments do not register this route.

SN-2026-002 — internode payload containment

Remote exploitation: yes; cluster-root / internode JWT required. Completes CVE-2026-42600: its fix removed one endpoint that exercised the gap; the gap itself — request bodies and grid frames never reaching the validity middleware, and no containment in the storage layer — remained across three further protocol surfaces. Closes path traversal on both the volume and path axes (including the peer-S3 bucket RPCs, which bypass the storage-REST wrapper entirely), an unrecoverable divide-by-zero that killed a node per RPC frame, metadata that reported truncated shards as intact, and three allocations sized from caller-declared values. Upgrade distributed-erasure deployments; single-node deployments register none of these routes. No S3 API behaviour changes; object keys containing . or .. path segments were already refused at the S3 boundary.

SN-2026-003 — policy condition value sources

Remote exploitation: yes (policy-dependent). Prevents raw request entries that spell condition-key names from shadowing or synthesizing internal condition values; confines s3:signatureAge to verified SigV4 presigned requests; separates query-only list fields from header-backed x-amz-* fields; and stops client request tags from impersonating stored existing-object tags. The compatible query form remains for storage class and upload tagging on handlers that consume it; an explicitly present header wins, including an empty header. Use request-tag conditions only on operations that consume tags. Header-only x-amz-* policy keys no longer accept query substitutes. See condition value sources and precedence.

Client source address trust — opt-in hardening, not a vulnerability

Fixed by fe6dc4780; no CVE assigned (the default matches upstream, and upstream’s own position is that IP-based restrictions are impractical without reliable source-IP visibility). Adds an enforceable forwarded-header trust boundary, MINIO_API_TRUSTED_PROXIES. Set to a list of addresses or CIDR blocks, forwarded headers are believed only from those peers and forwarding chains are read right-to-left past listed hops — which also stops the client-supplied left-most entry that an appending proxy leaves in place. Set to none, no forwarded header is believed at all. This is the guarantee _MINIO_API_XFF_HEADER=off never provided. No behaviour change for any existing deployment; the variable is opt-in and inert when unset. If you use IpAddress or NotIpAddress conditions, note that they were not enforceable before this change; the operator contract — including why the allowlist must name proxies rather than subnets and why multi-node deployments must include their own node addresses — is in the chronicle article and the settings reference.

SN-2026-004 — object-grant bucket reach

Remote exploitation: yes (policy-dependent). Withholds twelve sensitive bucket-level writes from an object-only resource pattern (arn:aws:s3:::bucket/*): PutBucketPolicy, DeleteBucketPolicy, PutBucketObjectLockConfiguration, PutBucketVersioning, PutReplicationConfiguration, PutBucketLifecycle, DeleteBucket, ForceDeleteBucket, PutBucketCors, DeleteBucketCors, PutBucketQOS, PutInventoryConfiguration. This is an authorization tightening; read the chronicle article before upgrading if you write your own bucket-scoped policies. Add the bare bucket ARN (arn:aws:s3:::bucket) alongside the wildcard form in any statement that legitimately grants one of the twelve. Built-in canned policies are unaffected; Deny statements and NotResource exclusions are untouched. MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on restores the historical behaviour in full. It is read during package initialization from the process environment; setting it only in MINIO_CONFIG_ENV_FILE is too late. See the setting.

SN-2026-005 — bare ARN prefix rejection

No direct remote exploit; policy-dependent. Rejects S3, S3 Tables, and KMS ARN namespace prefixes that name no resource, including their historical *arn:... serialization, in both Resource and NotResource, when creating named policies and when creating or updating service-account session policies. Existing policies keep loading, matching, importing, and replicating with unchanged runtime behavior, but a policy containing such a prefix cannot be submitted unchanged; replace it with the intended concrete resource, or use an explicit wildcard such as arn:aws:s3:::* only when all resources are intended. A “bare ARN prefix” (arn:aws:s3:::) is distinct from the valid “bare bucket ARN” of SN-2026-004 (arn:aws:s3:::bucket). IAM import, site-replication receive paths, stored-policy loading, and STS inline policies remain on the permissive compatibility path in this release. See the pkg v3.12.0 release note.

SN-2026-006 — SSE-C zero-byte reads

Remote exploitation: yes; requires read access to the object. Zero-byte SSE-C objects never unsealed the customer-provided key, so a wrong key was accepted with 200 instead of 403, and a copy or new version could be created under a key of the caller’s choosing without knowing the current one. Wrong keys now fail with 403 AccessDenied as on AWS; correct keys behave as before and no client change is needed. Inherited from upstream; every earlier release is affected.

SN-2026-007 — GetObjectAttributes on SSE-C objects

Remote exploitation: yes; requires read access to the object. Attributes of SSE-C objects were returned without authenticating the customer key, and a bare X-Minio-Source-Replication-Request header skipped the check entirely. A wrong key returns 403, a replication marker without the key returns 400; replication peers holding s3:ReplicateObject are unaffected. Inherited from upstream.

SN-2026-008 — internal replication headers

Remote exploitation: yes; any authenticated principal that can read or write the object. Completes CVE-2026-34204: internal headers such as X-Minio-Source-Etag, X-Minio-Source-Mtime, X-Minio-Source-Replication-Request, the replication SSE key headers, and X-Amz-Bucket-Replication-Status were still trusted on presence in most handlers. Replication semantics now require the exact marker value together with s3:ReplicateObject or s3:ReplicateDelete; other requests have these headers removed after signature verification. Site replication service accounts and bucket-replication targets that already hold the replication permissions are unaffected. Inherited from upstream.

SN-2026-009 — user/group status authorization

Remote exploitation: yes; authenticated admin API. Status changes were authorized against admin:EnableUser / admin:EnableGroup regardless of the requested status, so a principal allowed only to enable could also disable, and vice versa. Enable and disable now require the action matching the target status. Policies that grant only one of the pair lose the other operation; admin:* and the built-in consoleAdmin policy are unaffected. Inherited from upstream.

SN-2026-010 — explicit version delete authorization

Remote exploitation: yes; authenticated S3 API. Explicit version deletes were authorized as s3:DeleteObject with only a deny check on s3:DeleteObjectVersion, diverging from AWS. Explicit version deletes now require s3:DeleteObjectVersion. Two policy effects: principals granted only s3:DeleteObject can no longer delete specific versions, and a policy that relied on Deny s3:DeleteObject to block permanent deletes must also deny s3:DeleteObjectVersion, because Allow s3:* now permits explicit version deletes. Replication targets keep the s3:ReplicateDelete contract. Inherited from upstream.

SN-2026-011 — unsigned x-amz-* operation headers

A holder of a presigned or ordinary signed PUT can add an unsigned x-amz-copy-source without knowing the signing secret. On affected paths this changes a one-object write into CopyObject or UploadPartCopy, reading source data with the signer’s authority. A readable destination can expose the copied bytes. Published Server 20260903 is affected; the original fix is 123325430, followed by #177.

Ordinary SigV4 and presigned verification now reject unsigned x-amz-* headers with 400 AccessDenied. X-Amz-Content-Sha256 is the sole explicit header exception: its effective value is separately bound by the canonical request. #177 removed the internal X-Amz-Signature-Age header, constant and exemption; signature age comes from the signed date. Conforming ordinary signers keep working; custom clients must sign nonexempt headers before sending them. AWS uses a different HTTP status for this rejection, so this is not byte-for-byte response parity.

The streaming SigV4 seed verifier does not call this same coverage helper. Streaming auth is refused by the copy handler’s ordinary authentication dispatch, but the change must not be described as universal header coverage for every streaming PUT path. See the scope and residual boundary. Reported by Oren Yomtov; a CVE was requested. Upgrade the Server, restrict signing grants to the required objects and review anonymously readable destinations. A client or standalone Console update does not repair it.

SN-2026-012 — header-only presigned payload hash

A valid presigned request can bind a SHA-256 value supplied only through X-Amz-Content-Sha256, yet affected generic authenticated handlers did not verify the consumed body against it. A URL holder could change the body while retaining the valid signed request; PutBucketPolicy is a reproduced surface. This does not create permission the signer never had, but it defeats the intended signed-body restriction.

c4b5e1cb4 makes generic body verification use the same effective payload hash as signature verification: query value first, header fallback. Tampering with a checksum-bound body is rejected with XAmzContentSHA256Mismatch; explicit UNSIGNED-PAYLOAD keeps its protocol meaning. This is on main, not Server 20260903. Upgrade before depending on body-bound presigned administration; avoid distributing broad administrative presigned grants. See the chronicle.

SN-2026-013 — durable IAM revocation

A revoked identity or grant could return when stale site state, delayed notifications or incomplete recovery reintroduced it. The attacker needs a previously valid credential and an affected replay/recovery scenario; this is not unauthenticated identity creation. #191/#192 preserve deletion revisions, parent revocation boundaries and original group-grant times, and reject old child credentials after same-name parent recreation.

The repair is on main and absent from Server 20260903. Coordinated upgrade is required for every site and every process sharing an IAM backend, including shared backends without site replication. Back up complete persistent IAM state, not only a live-record export. Keep tombstones, reissue the required child credentials and reconcile revocations missing from older backups before reopening access. Ordinary group-member removal during an outage remains a separate limitation. See the design and recovery runbook.

SN-2026-014 — anonymous share-download proxy

The public Console download proxy could fetch non-object paths on its configured S3 origin, exposing endpoints such as public metrics that operators had isolated behind the Console network boundary. An anonymous caller could cross that boundary without a Console session. This is not a claim that the proxy bypassed S3 authentication or could read every private object.

Console #56 limits forwarding to object-content GETs at the configured origin, rejects system paths and query-selected non-download APIs before sending a request, and refuses all redirects. Ordinary public, presigned and versioned downloads remain supported; the existing shared-link format setting is not a global sharing-disable switch. Reported by Jiri Pejchal (@jiri-pejchal).

The standalone repair is published in Console v2.4.1. Server #209 selects the repaired Console on main, but published Server 20260903 still embeds an older Console. Upgrade the component that actually serves the UI; installing a standalone Console does not replace an embedded bundle. While awaiting a repaired Server build, restrict access to the exposed Console proxy and review the configured origin’s public endpoints. See the chronicle.

Dependency security updates

Rows list the absorbed fix and the commit or release that first carried it. Reachability and deployment exposure still need to be judged per release: an absorbed dependency fix is not a claim that the vulnerability was reachable in Silo.

Operationally significant security-related fixes

Attribution of this ledger

This page is maintained from the ledger previously carried in the repository at docs/security/advisories.md, updated through verified main f99ed829b5eba (2026-09-16). Release status statements are calibrated against the component matrix; each fix’s investigation, review, and verification detail lives in the linked chronicle article or release note.