https://silo.pgsty.com/tags/unsigned-trailer/Recent content in Unsigned Trailer on SILOHugoenTue, 04 Aug 2026 08:54:53 +0800https://silo.pgsty.com/blog/security/cve-2026-41145/Thu, 16 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-41145/<p><strong>Status:</strong> Released<br> <strong>First containing release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z">RELEASE.2026-04-17T00-00-00Z</a><br> <strong>GitHub advisory:</strong> <a href="https://github.com/advisories/GHSA-hv4r-mvr4-25vw">GHSA-hv4r-mvr4-25vw</a></p> <p>Query-string SigV4 credentials could enter a <code>STREAMING-UNSIGNED-PAYLOAD-TRAILER</code> data flow, while the old code verified the signature only when an <code>Authorization</code> header was present. A request carrying a valid access-key identifier could therefore complete a write without a correct signature.</p> <p>The final fix moved presigned rejection and SigV4 verification into <code>newUnsignedV4ChunkedReader()</code>, making every caller consuming that stream share one authentication boundary.</p> <h2 id="cve-number">Identifier note</h2> <p>The official CVE had not been assigned when the patch was written, so its commit subject used <code>fake CVE-2026-40027</code>. The final identifier is <strong>CVE-2026-41145</strong>. The historical commit remains unchanged; public material uses the official identifier.</p>