SILO Security Chronicle
This section publishes technical security advisories for PGSTY SILO, ordered from newest to oldest. Each advisory documents the affected versions, trigger conditions, root cause, code fix, and upgrade requirements.
For a single-page index of all CVE-* and SN-2026-* identifiers, fix commits, and dependency security updates, see the Security Advisory Ledger.
-
October Security Update: Object Lock, Admin Credentials and JWK Parsing
SILO Server 20261018 delivers the fixes for SN-2026-015, SN-2026-016, and SN-2026-017, scoped STS token revocation, and Go toolchain and dependency updates across silo, mcli, and silo-console. Server 20260916 and 20260903 are affected (and 20261015 …
SILO Server 20261018 delivers the fixes for SN-2026-015, SN-2026-016, and SN-2026-017, scoped STS token revocation, and Go toolchain and dependency updates across silo, mcli, and silo-console. Server 20260916 and 20260903 are affected (and 20261015 …
-
SN-2026-015 & SN-2026-016: S3 Object Lock Governance Retention Bypass and Version-Addressed Overwrites
SN-2026-015 and SN-2026-016 cover two S3 Object Lock retention and immutability vulnerabilities fixed in SILO Server 20261018 via PR #234 (14042b5aa) and PR #235 (0d3ba5d4c), as detailed in the companion repair design note. While the delete path …
SN-2026-015 and SN-2026-016 cover two S3 Object Lock retention and immutability vulnerabilities fixed in SILO Server 20261018 via PR #234 (14042b5aa) and PR #235 (0d3ba5d4c), as detailed in the companion repair design note. While the delete path …
-
September Security Repairs: Payload Integrity, IAM Revocation and Console Sharing
This bulletin covers three security repairs (SN-2026-012 through SN-2026-014) and adjacent dependency updates shipped in Server 20260916 and Console v2.4.1. See the security advisory ledger for the complete index. Finding Fixed source Delivery status …
This bulletin covers three security repairs (SN-2026-012 through SN-2026-014) and adjacent dependency updates shipped in Server 20260916 and Console v2.4.1. See the security advisory ledger for the complete index. Finding Fixed source Delivery status …
-
SN-2026-011: Fix and Release Status
SN-2026-011 was fixed on main starting with 123325430 on 2026-09-13 and shipped in Server 20260916. Server RELEASE.2026-09-03T13-18-01Z and earlier releases are affected (silo-pkg v3.14.0 and mcli 20260913 are client/library releases and do not patch …
SN-2026-011 was fixed on main starting with 123325430 on 2026-09-13 and shipped in Server 20260916. Server RELEASE.2026-09-03T13-18-01Z and earlier releases are affected (silo-pkg v3.14.0 and mcli 20260913 are client/library releases and do not patch …
-
SILO 20260903 Security Notes: SN-2026-006 through 010
This bulletin covers five security findings fixed in SILO Server 20260903 (RELEASE.2026-09-03T13-18-01Z), spanning customer-provided encryption keys (SSE-C), client-supplied replication headers, administrative status transitions, and explicit …
This bulletin covers five security findings fixed in SILO Server 20260903 (RELEASE.2026-09-03T13-18-01Z), spanning customer-provided encryption keys (SSE-C), client-supplied replication headers, administrative status transitions, and explicit …
-
SN-2026-019: Notification Keyspace Registration and Validation Redaction
SN-2026-019 covers a class of notification configuration defects fixed in Server 20260804 (162ded343 and 672c07a0f, pgsty/silo#39): notification parser and legacy-migration paths read or wrote KVS configuration keys that were missing from …
SN-2026-019 covers a class of notification configuration defects fixed in Server 20260804 (162ded343 and 672c07a0f, pgsty/silo#39): notification parser and legacy-migration paths read or wrote KVS configuration keys that were missing from …
-
SN-2026-018: Client Source Address Trust, Forwarded Headers, and aws:SourceIp
SN-2026-018 addresses client source-IP spoofing across aws:SourceIp IAM conditions, audit logs, bucket notification events, and admin HTTP traces in silo-pkg v3.12.0 (62f326d) and Server 20260804 (00a8171cb, pgsty/silo#41): handlers.GetSourceIP …
SN-2026-018 addresses client source-IP spoofing across aws:SourceIp IAM conditions, audit logs, bucket notification events, and admin HTTP traces in silo-pkg v3.12.0 (62f326d) and Server 20260804 (00a8171cb, pgsty/silo#41): handlers.GetSourceIP …
-
SN-2026-004: Object-Scoped Policy Grants Reaching Bucket Mutations
SN-2026-004 fixes an IAM resource-matching flaw in silo-pkg v3.11.0 (3c24ad1, 1f97549, d8b1fa7) and Server 20260804 (97b7d2804; upstream reference minio/minio#20449): when evaluating bucket-level S3 requests (args.ObjectName == ""), …
SN-2026-004 fixes an IAM resource-matching flaw in silo-pkg v3.11.0 (3c24ad1, 1f97549, d8b1fa7) and Server 20260804 (97b7d2804; upstream reference minio/minio#20449): when evaluating bucket-level S3 requests (args.ObjectName == ""), …
-
SN-2026-003: s3:versionid Condition Evaluation and Request Condition Hardening
SN-2026-003 and SN-2026-005 cover a set of S3 IAM policy evaluation fixes shipped in Server 20260804 (80c2c9d03, 2f55347f7, eee05a17c, and silo-pkg v3.12.0 commit 2b087a1; pgsty/silo#40, pgsty/silo#53): SN-2026-003 (80c2c9d03): getConditionValues …
SN-2026-003 and SN-2026-005 cover a set of S3 IAM policy evaluation fixes shipped in Server 20260804 (80c2c9d03, 2f55347f7, eee05a17c, and silo-pkg v3.12.0 commit 2b087a1; pgsty/silo#40, pgsty/silo#53): SN-2026-003 (80c2c9d03): getConditionValues …
-
Duplicate Part Numbers in CompleteMultipartUpload
In CompleteMultipartUpload, the S3 API requires part numbers in the completion XML to be strictly ascending. Up through Server 20260725, SILO enforced that invariant with sort.SliceIsSorted and a strict < comparator—which accepts non-decreasing …
In CompleteMultipartUpload, the S3 API requires part numbers in the completion XML to be strictly ascending. Up through Server 20260725, SILO enforced that invariant with sort.SliceIsSorted and a strict < comparator—which accepts non-decreasing …
-
SN-2026-002: Internode Path Containment Audit — Paying Off What CVE-2026-42600 Left Owing
Status: Released in Server 20260804 (release notes) Identifier: SN-2026-002 (Security Advisories) Fix commits: ca7baa670, b6f70ab08, 80e8eaa42, 1af351a70, a36fd8fff Affected scope: Distributed erasure deployments only; cluster-root / internode JWT …
Status: Released in Server 20260804 (release notes) Identifier: SN-2026-002 (Security Advisories) Fix commits: ca7baa670, b6f70ab08, 80e8eaa42, 1af351a70, a36fd8fff Affected scope: Distributed erasure deployments only; cluster-root / internode JWT …
-
CVE-2026-42600: ReadMultiple Storage-REST Path Traversal
Status: Released First containing release: RELEASE.2026-06-18T00-00-00Z Fix commit: 73ac524 GitHub advisory: GHSA-xh8f-g2qw-gcm7 Affected scope: Distributed erasure deployments only; cluster-root / internode JWT required The internode storage-REST …
Status: Released First containing release: RELEASE.2026-06-18T00-00-00Z Fix commit: 73ac524 GitHub advisory: GHSA-xh8f-g2qw-gcm7 Affected scope: Distributed erasure deployments only; cluster-root / internode JWT required The internode storage-REST …
-
CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: f444b6f37 GitHub advisory: GHSA-hv4r-mvr4-25vw Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: f444b6f37 GitHub advisory: GHSA-hv4r-mvr4-25vw Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the …
-
CVE-2026-40344: Snowball Auto-Extract Authentication Bypass
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: efb6e5b00 GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: efb6e5b00 GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the …
-
CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass
Status: Released; second-round fix completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z Fix commits: 3252d5b, 5dc705936 (fd69c89) GitHub issue: pgsty/silo#25 Our initial April patch …
Status: Released; second-round fix completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z Fix commits: 3252d5b, 5dc705936 (fd69c89) GitHub issue: pgsty/silo#25 Our initial April patch …
-
CVE-2026-34204: Replication Metadata Injection
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: 56fa63b GitHub issue: pgsty/silo#24 Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: 56fa63b GitHub issue: pgsty/silo#24 Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into …
-
CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain
Status: Released, followed by two rounds of hardening First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665 GitHub issue: pgsty/silo#23 The …
Status: Released, followed by two rounds of hardening First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665 GitHub issue: pgsty/silo#23 The …
-
CVE-2026-33322: OIDC JWT Algorithm Confusion
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants Fix commit: d24f449 GitHub issue: pgsty/silo#22 The previous OIDC implementation in …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants Fix commit: d24f449 GitHub issue: pgsty/silo#22 The previous OIDC implementation in …
-
CVE-2026-32285: The jsonparser Advisory That Required No Patch
Status: Closed without a code change GitHub issue: pgsty/silo#26 Referenced upstream commit: c1a49490 (CVE-2025-62506) The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of …
Status: Closed without a code change GitHub issue: pgsty/silo#26 Referenced upstream commit: c1a49490 (CVE-2025-62506) The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of …
-
CVE-2025-62506: Session-Policy Privilege Escalation
Status: Inherited and released First SILO community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account …
Status: Inherited and released First SILO community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account …