SN-2026-023: Authenticated STREAMING-UNSIGNED-PAYLOAD-TRAILER Replay Window and Missing SigV4 Condition Keys

Wed, 11 Nov 2026 00:00:00 +0000

Status: Fixed on main (14ecb222e, 296c9710b); scheduled for the next post-20261109 Server release
Identifier: SN-2026-023 (Security Advisory Ledger, #338)
Severity: High
Affected scope: SILO Server (RELEASE.2026-11-09T00-00-00Z and earlier) and inherited upstream MinIO releases since 2023-05-05 (76913a9fd)
Unaffected components: silo-console, mcli, silo-pkg, and kes

AWS S3’s STREAMING-UNSIGNED-PAYLOAD-TRAILER mode signs the initial HTTP request headers using Signature Version 4 (Authorization: AWS4-HMAC-SHA256 ...) while transmitting aws-chunked body chunks and trailing checksums without per-chunk cryptographic signatures. Because the canonical request binds the literal token "STREAMING-UNSIGNED-PAYLOAD-TRAILER" rather than a SHA-256 digest of the payload, bounding the validity window of the signed X-Amz-Date header (globalMaxSkewTime = 15 minutes) is the sole time bound preventing old captured request headers from being replayed.

Streaming on SILO

SN-2026-023: Authenticated STREAMING-UNSIGNED-PAYLOAD-TRAILER Replay Window and Missing SigV4 Condition Keys