GHSA-9c4q-hq6p-c237 · 深刻度： high · エコシステム： go — MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.
総合評価: CVE-2026-40344 は中リスク（47.9/100）。CVSS 深刻度は高。悪用される可能性が高い（EPSS 0.16%、36 パーセンタイル） 推奨対応: 影響資産を整理し、修補計画に組み込んでください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-05-24 | 0.15% | 0.16% | +0.01% |
| 2 | 2026-04-28 | 0.15% | 0.15% | -0.01% |
| 3 | 2026-04-22 | — | 0.15% | — |
EPSS の全履歴 （全 3 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 8.8 | 4.0 | HIGH |
|
— | — | [email protected] |
| 8.2 | 3.1 | HIGH |
|
3.9 | 4.2 | [email protected] |
GHSA-9c4q-hq6p-c237 · 深刻度： high · エコシステム： go — MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
| URL | タグ |
|---|---|
| https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091 | Patch |
| https://github.com/minio/minio/pull/16484 | Issue Tracking |
| https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237 | Patch Vendor Advisory |