CVE-2026-113466: MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Prioritize MinIO deployments running releases up to RELEASE.2025-10-15T17-29-55Z, particularly where the Embedded Console is in use. The issue is stated to affect only products that are no longer supported by the maintainer.
Does an attacker need credentials or user interaction to exploit this issue?
No credentials or user interaction are indicated. The supplied vector identifies the issue as remotely reachable with low attack complexity and no privileges required.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used, so exposed affected deployments should be treated as having a known exploitation path.