GHSA-48rv-pgqh-mhjg: High severity vulnerability

Published Nov 5, 2026

Updated

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz- headers, letting a presigned PUT URL be escalated into a cross-bucket read.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MinIO to a version that resolves this vulnerability.
Fixed in RELEASE.2026-09-22T19-25-18Z

Event History

Nov 5, 2026

CVE Published

via OSV·10:00 PM

Data Sourced

via OSV·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

MinIO releases before RELEASE.2026-09-22T19-25-18Z are affected. Deployments on that release or a later release are not identified as affected by the advisory.

What does an attacker need to exploit this issue?

An attacker needs a presigned PUT URL. The issue arises because unsigned x-amz-* headers are accepted during Signature V4 verification, enabling escalation from that URL to a cross-bucket read.

How can I determine whether my environment is at risk?

Check the MinIO release running in the environment and whether presigned PUT URLs are issued. Instances running a release earlier than RELEASE.2026-09-22T19-25-18Z should be treated as vulnerable.

GHSA-48rv-pgqh-mhjg: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my environment is at risk?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my environment is at risk?