---
id: "CVE-2023-28432"
kind: "vulnerability"
aliases: ["CVE-2023-28432"]
title: "Minio is a Multi-Cloud Object Storage framework"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "MinIO MinIO", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "minio", "fixed": ["2023-03-20t20-16-18z"], "affected": ">= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "kubernetes", "minio", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "single-node-deployment"]
published_at: "2023-03-22T21:15:18+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28432", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28432", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Minio is a Multi-Cloud Object Storage framework

MinIO, an S3-compatible object storage server, returns all of its environment variables in cluster deployments. An attacker who can reach the server can read those variables, which often contain access keys and other secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MinIO MinIO affected ? fixed ?
- vendor:minio affected >= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z fixed 2023-03-20t20-16-18z

## Fix

Upgrade MinIO to a release that includes the fix for CVE-2023-28432; the sources do not name the fixed version. Rotate any credentials that were set as MinIO environment variables.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28432
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-28432

## From the sources

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_