Security Advisories

This ledger summarizes security fixes and upgrade-impacting security notes across the pgsty/silo stack. Each advisory with its own deep-dive investigation links to its full article in the Security Chronicle or Design Notes; this page serves as the canonical index of identifiers, fix commits, exposure conditions, and upgrade boundaries.

Entries with a public CVE use that identifier. Because upstream minio/minio is archived and no longer coordinates CVE assignments for inherited code, findings without a CVE carry a stable SN-<year>-<sequence> identifier (SN-2026-002 through SN-2026-019) so release notes, commits, and issues can reference them unambiguously. SN-2026-001 tracks a non-security streaming-flush regression in trackingResponseWriter (Server 20260804).

Current Release Boundary

The current production baseline is Server 20261026, Console v2.5.1 and mcli 20261026, all selecting silo-pkg v3.15.2 and Go 1.27.3. KES 20261026 is the optional external key service. This release retains the earlier security fixes below and adds the dependency security updates. The first fixed versions remain:

• Server 20261018 fixes SN-2026-015 (PutObjectRetention governance bypass), SN-2026-016 (version-addressed and in-place Object Lock overwrites), and SN-2026-017 (Admin credential authorization boundaries), and adds scoped STS token revocation (0cd388c66). Server 20260916 and earlier remain affected by SN-2026-015 through SN-2026-017; deploy the upgrade to every Server node and replication peer accepting writes. See the October security note and Component Version Matrix.
• Server 20260916 and Console v2.4.1 include SN-2026-011 through SN-2026-014, which are absent from Server 20260903.
• Server 20260903 includes SN-2026-006 through SN-2026-010.
• Server 20260804 and silo-pkg v3.11.0 / v3.12.0 include SN-2026-002 through SN-2026-005, SN-2026-018, and SN-2026-019.

Inherited Upstream Advisory Baseline

SILO cut its first community release (RELEASE.2025-12-03T12-00-00Z) from upstream history that already contained CVE-2025-62506.

Advisories Since RELEASE.2026-03-21T00-00-00Z

Exposure and Upgrade Guidance

CVE-2025-62506 — Session-Policy Privilege Escalation

Remote exploitation: yes (authenticated service account or STS session carrying an inline session policy). Upstream fixed the DenyOnly evaluation reset in c1a49490 (RELEASE.2025-10-15T17-29-55Z), and every SILO release since RELEASE.2025-12-03T12-00-00Z inherits it. Operators migrating from an unpatched upstream MinIO release should upgrade and audit child service accounts created by restricted parent sessions. See the CVE-2025-62506 chronicle.

CVE-2026-32285 — Mislabeled jsonparser Advisory

Public feeds describe CVE-2026-32285 as a buger/jsonparser vulnerability, but its referenced upstream fix (c1a49490) is the session-policy commit for CVE-2025-62506. SILO already selects github.com/buger/jsonparser v1.1.2 and govulncheck confirms no reachable vulnerable symbols. See the CVE-2026-32285 investigation.

CVE-2026-33322 — OIDC JWT Algorithm Confusion

Remote exploitation: yes, if OIDC is enabled (AssumeRoleWithWebIdentity or AssumeRoleWithClientGrants) and an attacker knows or can guess client_secret to forge an HS256/HS384/HS512 token. Commit d24f449e0 binds JWT verification strictly to the provider’s asymmetric JWKS keys and removes the client_secret HMAC fallback from token.Parse. Deployments that relied on symmetric HMAC id_tokens must switch their IdP to asymmetric signing (RS256, ES256, etc.).

CVE-2026-33419 — LDAP STS Enumeration and DoS

Remote exploitation: yes, if LDAP is configured (AssumeRoleWithLDAPIdentity). Returns a uniform 400 InvalidParameterValue on authentication failure without leaking internal directory errors, bounds concurrent LDAP bind operations with a reserve/commit/cancel/refund lifecycle, and removes the shared per-username rate-limit bucket (which previously allowed an attacker who knew a victim’s LDAPUsername to lock out that user from rotating source IPs). See the LDAP STS chronicle.

CVE-2026-34204 — Replication Metadata Injection

Remote exploitation: yes. Blocks untrusted X-Minio-Replication-* headers on client PutObject and CopyObject requests from being stored as internal replication metadata and leaving objects unreadable. Upgrade any server that accepts untrusted object writes. See SN-2026-008 and Replica Metadata Normalization for the subsequent replication-header hardening.

CVE-2026-39414 — S3 Select Oversized Record Memory Exhaustion

Remote exploitation: yes (s3:SelectObjectContent). Rejects CSV and JSON Lines records exceeding 1 MiB (maxCharsPerRecord) with OverMaxRecordSize instead of buffering unbounded lines in memory. The April patch (3252d5b7f) enforced the limit on CSV and standard JSON readers; the June follow-up (5dc705936) routes JSON Lines on AVX2/AVX-512 CPUs through the bounded json.PReader instead of simdj.NewReader, closing the hardware-specific SIMD bypass. See the S3 Select chronicle.

CVE-2026-41145 — Unsigned-Trailer Query Authentication Bypass

Remote exploitation: yes. Closes the presigned query-string authentication bypass when X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER is sent on PutObject or PutObjectPart. Upgrade any server reachable by clients on object write endpoints.

CVE-2026-40344 — Snowball Auto-Extract Authentication Bypass

Remote exploitation: yes. Verifies SigV4 authentication in newUnsignedV4ChunkedReader() before PutObjectExtract begins untar() extraction on Snowball unsigned-trailer uploads, guaranteeing that unauthenticated streams never reach the tar extractor.

CVE-2026-42600 — Internode ReadMultiple Path Traversal

Remote exploitation: yes (requires cluster-root / internode JWT). Removes the unused /rmpl (xlStorage.ReadMultiple) RPC endpoint that allowed msgpack request payloads to traverse outside configured drive roots. Single-node deployments do not register internode routes; distributed erasure deployments should upgrade.

SN-2026-002 — Internode Payload Path and Memory Containment

Remote exploitation: yes (requires cluster-root / internode JWT). Completes CVE-2026-42600 across the remaining internode protocol surfaces (storageREST, peerREST, grid WebSocket multiplexing, and xlStorage). Enforces path containment at two storage-layer chokepoints (getVolDir/NSScanner and getStorage() via guardPaths, hasBadPathComponent, and isVolumeRootAlias), caps caller-declared slice allocations (maxDeleteVersions = 1000, max BitrotVerifier size), validates erasure DataBlocks/ParityBlocks before division to prevent per-frame node panics, and verifies shard lengths before reporting intact data. Single-node deployments do not register these routes; no S3 API behavior changes. See the internode containment chronicle.

SN-2026-003 — Policy Condition Value Sources

Remote exploitation: yes (policy-dependent). Prevents raw HTTP query parameters or headers that spell internal IAM condition-key names from shadowing or synthesizing server-derived condition values; confines s3:signatureAge to verified SigV4 presigned requests; separates query-only list parameters from header-backed x-amz-* condition keys; prevents client request tags from impersonating stored ExistingObjectTag values; and evaluates s3:VersionId against the whitespace-trimmed version ID only when ?versionId is actually present. See the version-ID and condition chronicle and condition value sources reference.

SN-2026-004 — Object-Grant Bucket Reach

Remote exploitation: yes (policy-dependent). Withholds 12 sensitive bucket-level write actions from object-only resource patterns (arn:aws:s3:::bucket/*): PutBucketPolicy, DeleteBucketPolicy, PutBucketObjectLockConfiguration, PutBucketVersioning, PutReplicationConfiguration, PutBucketLifecycle, DeleteBucket, ForceDeleteBucket, PutBucketCors, DeleteBucketCors, PutBucketQOS, and PutInventoryConfiguration, and requires a single Allow statement to match both the action and the resource (monotone intersection). Read the SN-2026-004 chronicle before upgrading if you maintain custom bucket-scoped IAM policies: add the bare bucket ARN (arn:aws:s3:::bucket) alongside arn:aws:s3:::bucket/* in any statement intended to grant those 12 bucket-level writes. Built-in canned policies, Deny statements, and NotResource exclusions are unaffected. Setting MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on in the process environment before startup restores legacy matching (MINIO_CONFIG_ENV_FILE is read too late for package init).

SN-2026-005 — Bare ARN Prefix Rejection

Policy-hardening change (silo-pkg v3.12.0 / Server eee05a17c). Rejects S3, S3 Tables, and KMS ARN namespace prefixes that name no resource (arn:aws:s3::: and its historical *arn:aws:s3::: form) in both Resource and NotResource when creating named policies or creating/updating service-account session policies. Existing stored policies continue loading, matching, importing, and replicating without disruption, but re-submitting a policy containing a bare prefix requires replacing it with the concrete bucket/object ARN or an explicit wildcard (arn:aws:s3:::*). Note that a bare ARN prefix (arn:aws:s3:::) is distinct from a valid bare bucket ARN (arn:aws:s3:::bucket). See the SN-2026-003 / SN-2026-005 chronicle and silo-pkg v3.12.0 release notes.

SN-2026-006 — Zero-Byte SSE-C Object Key Authentication

Remote exploitation: yes (requires read access to the object). Zero-byte SSE-C objects previously returned 200 OK without unsealing the customer-provided key, allowing a caller with the wrong SSE-C key to pass HeadObject/GetObject or copy/overwrite the object under a newly chosen key. Zero-byte SSE-C reads and copies now unseal and verify the customer key, returning 403 AccessDenied on key mismatch as on AWS S3. Shipped in Server 20260903.

SN-2026-007 — GetObjectAttributes on SSE-C Objects

Remote exploitation: yes (requires read access to the object). GetObjectAttributes previously returned object attributes for SSE-C objects without authenticating the customer key, and skipped the check whenever a client sent X-Minio-Source-Replication-Request. Wrong SSE-C keys now return 403 AccessDenied, and unauthenticated replication markers return 400 InvalidArgument; authorized replication peers holding s3:ReplicateObject remain unaffected. Shipped in Server 20260903.

SN-2026-008 — Post-Auth Trust Boundary for Internal Replication Headers

Remote exploitation: yes (any authenticated principal with read or write access to the object). Completes CVE-2026-34204: internal headers (X-Minio-Source-Etag, X-Minio-Source-Mtime, X-Minio-Source-Replication-Request, X-Minio-Source-DeleteMarker, replication SSE key headers, and X-Amz-Bucket-Replication-Status) were previously trusted on mere presence in several handlers. Server 20260903 strips these headers from a post-authentication clone unless the caller sends the exact marker value and holds s3:ReplicateObject or s3:ReplicateDelete. Site replication service accounts and bucket-replication targets holding replication permissions are unaffected. See the chronicle and CORS & Replication Trust Design.

SN-2026-009 — User and Group Status Authorization

Remote exploitation: yes (authenticated Admin API). SetUserStatus and UpdateGroupStatus previously checked admin:EnableUser and admin:EnableGroup regardless of whether the request enabled or disabled the target, allowing an operator granted only enable permission to disable accounts (and vice versa). Status changes now check admin:EnableUser / admin:DisableUser and admin:EnableGroup / admin:DisableGroup according to the requested target state. Policies granting admin:* or consoleAdmin are unaffected; least-privilege policies granting only one action of the pair now authorize only that direction. See the chronicle and User Status Permissions Design.

SN-2026-010 — Explicit Object Version Delete Authorization

Remote exploitation: yes (authenticated S3 API). DeleteObject?versionId=... and DeleteObjects entries carrying a VersionId were previously authorized against s3:DeleteObject with only a negative check for Deny s3:DeleteObjectVersion. Explicit version deletes now require s3:DeleteObjectVersion, matching AWS S3. Two policy effects: principals granted only s3:DeleteObject can still create delete markers on unversioned DELETE calls but can no longer permanently delete specific versions; and policies that relied solely on Deny s3:DeleteObject alongside Allow s3:* to block permanent version deletion must also add Deny s3:DeleteObjectVersion. Replication targets retain the s3:ReplicateDelete contract. See DeleteObjectVersion Authorization.

SN-2026-011 — Unsigned X-Amz-* Operation Headers

Remote exploitation: yes (holder of a presigned URL or intercepted Authorization-header PUT request). Because cmd/api-router.go dispatches PUT requests carrying x-amz-copy-source to CopyObjectHandler, an attacker holding a presigned PUT URL could append an unsigned x-amz-copy-source: /src/secret header and trick the server into copying any object readable by the signer into the destination object. Reported by Oren Yomtov.

Fixed in Server 20260916 (status note, 123325430, PR #173 and #177). Both doesPresignedSignatureMatch and doesSignatureMatch now invoke checkUnsignedHeaders and reject any request carrying an unsigned X-Amz- header with 400 AccessDenied (ErrUnsignedHeaders). X-Amz-Content-Sha256 is the sole explicit header exemption because its payload digest is bound by the canonical request and verified by SN-2026-012; PR #177 also derives s3:signatureAge directly from the signed X-Amz-Date without mutating r.Header. Standard AWS SDKs, mcli, and minio-go already sign all X-Amz- headers; custom clients that append X-Amz-* headers to a presigned URL must include them in X-Amz-SignedHeaders at signing time. See Signed Header Coverage Design.

SN-2026-012 — Header-Only Presigned Payload Hash Verification

Remote exploitation: yes (holder of a presigned URL whose payload hash was bound via X-Amz-Content-Sha256 header rather than query string). Generic authenticated handlers such as PutBucketPolicy previously verified the signature against the header digest but did not verify the consumed request body against that digest, allowing a holder of the presigned URL to substitute a different body. Commit c4b5e1cb4 (Server 20260916) binds generic body verification to the same effective payload hash used during signature verification (query parameter first, header fallback) and rejects tampered bodies with XAmzContentSHA256Mismatch.

SN-2026-013 — Durable IAM Revocation and Scoped STS Revocation

Remote exploitation: requires a previously issued credential and a restart, peer-sync delay, or same-name parent recreation scenario. Before Server 20260916 (#191, #192, f99ed829b), disabling or deleting a user, rotating credentials, or recreating a user under the same name could leave previously minted STS tokens or child service accounts valid until JWT expiration, or allow stale site-replication records to resurrect deleted identities. Server 20260916 persists deletion tombstones, parent revocation timestamps, and group-grant revisions under .minio.sys/iam/revocations/, and Server 20261018 (0cd388c66) adds POST /minio/admin/v3/sts-revoke for per-principal and per-token (jti) STS revocation without invalidating unrelated sessions. Coordinate upgrades across all nodes sharing an IAM backend; see IAM Revocations Design and the IAM Upgrade Runbook.

SN-2026-014 — Anonymous Console Share-Download Proxy Restriction

Remote exploitation: yes (anonymous caller reaching the Console /api/v1/download-shared-object endpoint). The Console share-download proxy previously accepted arbitrary paths and query parameters on its configured S3 origin, allowing an unauthenticated caller to reach internal origin paths (such as /minio/v2/metrics/cluster) that operators had isolated behind the Console network boundary. Reported by Jiri Pejchal (@jiri-pejchal). Fixed in Console v2.4.1 (silo-console#56) and embedded in Server 20260916 (#209): the proxy now restricts forwarding strictly to single-object GET downloads on the configured S3 origin, rejects /minio/* system paths and subresource management queries before dialing, and refuses HTTP redirects.

SN-2026-015 — PutObjectRetention Authorization and Governance Bypass

Remote exploitation: yes (authenticated S3 caller). Three flaws in PutObjectRetentionHandler (cmd/object-handlers.go) allowed an authenticated caller to: (1) modify object retention without holding s3:PutObjectRetention by supplying X-Amz-Bypass-Governance-Retention: true when holding s3:BypassGovernanceRetention (short-circuiting the base action check); (2) clear (Mode: "") or shorten an active GOVERNANCE lock using only s3:PutObjectRetention without s3:BypassGovernanceRetention; and (3) bypass IAM Deny policies on s3:object-lock-remaining-retention-days when clearing retention. Fixed in Server 20261018 (PR #234, #235, 14042b5aa): s3:PutObjectRetention is unconditionally enforced before object lookup, weakening or clearing an active GOVERNANCE lock requires both X-Amz-Bypass-Governance-Retention: true and s3:BypassGovernanceRetention, and clearing retention evaluates s3:object-lock-remaining-retention-days = 0. See the SN-2026-015 / SN-2026-016 Advisory and Repair Architecture.

SN-2026-016 — Version-Addressed and In-Place Object Lock Overwrites

Remote exploitation: yes (authenticated S3 writer). Callers supplying ?versionId=<existing-uuid> on PutObject, CopyObject, CompleteMultipartUpload, or PutObjectExtract, or overwriting unversioned/null-version objects in place (including directory objects and multipart completions), could overwrite an existing version protected by COMPLIANCE or GOVERNANCE retention or LegalHold without triggering an Object Lock check. Fixed in Server 20261018 (14042b5aa, 0d3ba5d4c): S3 handlers reject caller-supplied ?versionId= unless the request is an authenticated replication write (isReplicationRequest), preflight checks fail closed on unreadable metadata, and storage write paths (PutObject, CopyObject, CompleteMultipartUpload, PutObjectDir) re-verify destination version lock state (checkObjectLockForOverwrite) inside the namespace write lock. Upgrade every Server node and replication peer accepting writes. See the Repair Architecture.

SN-2026-017 — Delegated IAM Admin Credential Authorization Boundaries

Remote exploitation: yes (authenticated delegated IAM administrator or restricted derived credential). In Server 20260916 and earlier, delegated admins holding admin:CreateUser, admin:AttachUserOrGroupPolicy, or admin:UpdateServiceAccount could assign policies broader than their own effective permissions, mutate higher-privilege users/groups/service accounts, or use self-service admin routes to escape session-policy or Deny restrictions. Fixed in Server 20261018 (2616d43fb, 995439260, PR #242): delegated IAM mutations now enforce target-policy containment (authorizePolicyChange, authorizeGroupTargets, authorizeTargetUser) and block non-root self-permission escalation (ErrAdminChangeUserSelfPermission). See IAM Admin Authorization Design.

SN-2026-018 — Client Source Address Trust Boundary (MINIO_API_TRUSTED_PROXIES)

Forwarded-Header Trust Policy

Opt-in security hardening (fe6dc4780, shipped in Server 20260804). By default, inherited upstream code trusts X-Forwarded-For and X-Real-IP from any direct peer, allowing clients that can reach the server directly (or behind an appending proxy) to spoof aws:SourceIp IAM conditions and evade per-IP LDAP rate limits. MINIO_API_TRUSTED_PROXIES establishes an enforceable trust boundary: when set to none, forwarded headers are never trusted; when set to a comma-separated list of proxy IPs or CIDRs, forwarded headers are accepted only from listed peers (plus loopback sidecars) and X-Forwarded-For is walked right-to-left past trusted hops to extract the first untrusted client IP. Multi-node clusters that enable MINIO_API_TRUSTED_PROXIES must include their own cluster node IPs/CIDRs in the list so peer-forwarded S3 requests preserve the original client IP. See the Source Address Trust Chronicle and Settings Reference.

SN-2026-019 — Notification Key Registration and Secret Redaction

Config-subsystem hardening (672c07a0f in Server 20260804, followed by f1ba68358 in Server 20260903). Auditing notify_postgres and notify_mysql revealed that config.HasSensitiveKeys did not redact password, dsn_string, or connection_string when returning validation errors or GetConfigKV payloads, and five discrete connection keys were missing from the registered Keyspace. Commit 672c07a0f added credential redaction in config.HasSensitiveKeys and a structural test verifying key registration across all config subsystems; Server 20260903 subsequently retired the five discrete keys in favor of connection_string and dsn_string to eliminate split-brain overwrites during startup migration. See the Notification Keyspace Chronicle and Notify URL Design.

Dependency Security Updates

Server 20261018 builds with Go 1.27.2 and selects golang.org/x/net v0.61.0, golang.org/x/crypto v0.58.0, golang.org/x/text v0.43.0, and github.com/go-jose/go-jose/v4 v4.1.6 (note that the go-jose RSA JWK parsing fix rejects RSA keys larger than 4096 bits; verify OIDC/JWKS identity providers before upgrading). Unified Go 1.27.3 and static curl 8.23.0 updates are tracked in SILO 20261026.

Operationally Significant Security-Related Fixes

Ledger Provenance

This page is maintained from the advisory ledger originally tracked in pgsty/silo (docs/security/advisories.md through f99ed829b5eba / 40220bd836cb) and aligned with the Component Version Matrix. Full root-cause traces, rejected design alternatives, and verification commands live in the linked Security Chronicle and Design Notes articles.