CVE-2025-62506: Session-Policy Privilege Escalation
Status: Inherited and released
First Silo community release: RELEASE.2025-12-03T12-00-00Z
Upstream fixed release: RELEASE.2025-10-15T17-29-55Z
GitHub advisory: GHSA-jjjj-jwhf-8rgr
Upstream fix: minio/minio#21642
A service account or STS account with a restricted session policy could use an “own account” operation to create another service account without the restriction. The child account then inherited broader parent permissions, turning valid low-privilege credentials into a privilege-escalation path.
Silo did not need a separate backport. The upstream fix and its two regression groups were already in the history from which the community fork was released. This note records that inheritance without duplicating the tests or reconstructing the investigation already captured by the upstream advisory and PR.
Commit mapping
| Role | Repository | Commit | Evidence |
|---|---|---|---|
| Upstream remediation | minio/minio |
c1a49490 |
Merge commit for PR #21642 |
| Silo inheritance | pgsty/silo |
c1a49490 |
The fork preserves the same commit object and SHA; the first Silo community release descends from it |
The identical SHA is the mapping: this is inherited source history, not an independent Silo implementation with a merely similar patch. The repository’s canonical advisory ledger keeps the same source-to-fork record.
Regression evidence
PR #21642 added two regression groups and runs each against root and non-root parents:
TestServiceAccountPrivilegeEscalationBug2_2025_10_15covers restricted service accounts.TestSTSPrivilegeEscalationBug2_2025_10_15covers restricted STS accounts.
Both remain wired into the standard cmd test suites, so go test ./cmd executes them. No parallel or replacement regression test was added for this publication update.
Fix and operator boundary
When a session policy exists, the fix clears the DenyOnly shortcut before evaluating it. An “own account” exception therefore cannot turn “not explicitly denied” into permission: the restricted policy must actually allow the action.
Every Silo community release contains this commit. Operators migrating from a MinIO build older than the upstream fixed release should upgrade, review service accounts created by restricted service or STS identities, and revoke suspicious child accounts. This inheritance statement does not extend support to historical Silo releases; the current release line remains the supported line.