{"id":"CVE-2023-28432","kind":"vulnerability","aliases":["CVE-2023-28432"],"related":[],"title":"Minio is a Multi-Cloud Object Storage framework","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","summary":"MinIO, an S3-compatible object storage server, returns all of its environment variables in cluster deployments. An attacker who can reach the server can read those variables, which often contain access keys and other secrets.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-04-21T00:00:00+00:00","products":[{"name":"MinIO MinIO","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"minio","fixed":["2023-03-20t20-16-18z"],"affected":">= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","kubernetes","minio","package","self-hosted"],"not_affected_if":["managed-hosting","single-node-deployment"],"how_to_check":null,"fix":"Upgrade MinIO to a release that includes the fix for CVE-2023-28432; the sources do not name the fixed version. Rotate any credentials that were set as MinIO environment variables.","status":"open","published_at":"2023-03-22T21:15:18+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:52+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:06:52Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade MinIO to a release that includes the fix for CVE-2023-28432; the sources do not name the fixed version. Rotate any credentials that were set as MinIO environment variables.","reach":"network","impact":"high","summary":"MinIO, an S3-compatible object storage server, returns all of its environment variables in cluster deployments. An attacker who can reach the server can read those variables, which often contain access keys and other secrets.","category":"package","who_cares":["minio","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads environment variables holding root credentials and secrets","analyst_note":"Confirm fixed version and whether the flaw needs a cluster deployment, via the MinIO security advisory for CVE-2023-28432 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-node-deployment","managed-hosting"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2776,"output_tokens":370,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,14A '-28432':12A,15A 'access':57B 'advis':109C 'attack':44B 'cloud':6A,67C 'cluster':41B,73C 'compat':30B 'contain':56B 'cve':10A,13A 'deploy':42B,74C,103C 'disclosur':98C 'distribut':102C 'environ':38B,85C 'exploit':19B 'framework':9A,70C 'host':25B 'impact':105C 'includ':87C 'inform':97C 'key':58B,90C 'kubernet':20B 'minio':1A,16A,17A,18A,21B,26B,62C,82C,88C,92C 'multi':5A,66C 'multi-cloud':4A,65C 'object':7A,31B,68C 'often':55B 'packag':22B 'password':94C 'prior':79C 'reach':47B 'read':51B 'release.2019-12-17t23-16-33z':77C 'release.2023-03-20t20-16-18z':81C,113C 'result':95C 'return':34B,83C 'root':93C 's3':29B 's3-compatible':28B 'secret':61B,89C 'self':24B 'self-host':23B 'server':33B,49B 'start':75C 'storag':8A,32B,69C 'upgrad':111C 'user':100C,107C 'variabl':39B,53B,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-22T21:15:18+00:00","kev":{"dateAdded":"2023-04-21","dueDate":"2023-05-12","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-28432","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28432","severity":null,"published_at":"2023-04-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-28432","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28432","severity":null,"published_at":"2023-03-22T21:15:18+00:00","modified_at":"2026-06-17T05:47:42+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}