Live › vulnerability › CVE-2023-28432
Go to dashboardMinIO, an S3-compatible object storage server, returns all of its environment variables in cluster deployments. An attacker who can reach the server can read those variables, which often contain access keys and other secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MinIO MinIO | vendor | – | – |
| minio | vendor | >= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z | 2023-03-20t20-16-18z |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY
and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
This page as .md · .json · in your agent: get_signal("CVE-2023-28432")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.