CVE-2026-122267: High severity vulnerability

Published Nov 5, 2026

Updated

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz- headers, letting a presigned PUT URL be escalated into a cross-bucket read.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MinIO to a version that resolves this vulnerability.
Fixed in RELEASE.2026-09-22T19-25-18Z

Frequently Asked Questions

Which deployments are exposed?

MinIO releases before RELEASE.2026-09-22T19-25-18Z are affected. The issue applies where presigned PUT URLs can be used against the service.

What does an attacker need to exploit this issue?

An attacker needs a presigned PUT URL. They can use unsigned x-amz-* headers during Signature V4 verification to escalate that URL into a cross-bucket read.

What should be done to remediate the issue?

Upgrade MinIO to RELEASE.2026-09-22T19-25-18Z or a later release. No alternative mitigation is provided in the available information.

CVE-2026-122267: High severity vulnerability

Remediation

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done to remediate the issue?