Live › vulnerability › CVE-2026-113466
Go to dashboardMinIO releases up to RELEASE.2025-10-15T17-29-55Z use a hard-coded cryptographic key in the embedded console's session token authentication in cmd/common-main.go. An attacker who knows the key can likely forge session tokens and reach the console remotely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted MinIO at or before RELEASE.2025-10-15T17-29-55Z with the embedded console exposed to a network. The sources say the affected versions are no longer maintained, so no upstream patch is confirmed. Managed object storage users are not affected by this build.
No product ranges from the sources yet.
minio --version and compare against RELEASE.2025-10-15T17-29-55ZRELEASE.2025-10-15T17-29-55Z; the sources say this affected release line is no longer supported, so the fix is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-113466")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.