{"id":"CVE-2026-113466","kind":"vulnerability","aliases":["CVE-2026-113466"],"related":[],"title":"MinIO: hard-coded cryptographic key in embedded console session auth","description":"A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key\r . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"MinIO releases up to RELEASE.2025-10-15T17-29-55Z use a hard-coded cryptographic key in the embedded console's session token authentication in cmd/common-main.go. An attacker who knows the key can likely forge session tokens and reach the console remotely.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["minio","object-storage","package","self-hosted"],"not_affected_if":["managed-hosting","newer-release"],"how_to_check":"- Run `minio --version` and compare against `RELEASE.2025-10-15T17-29-55Z`\n- Check whether the embedded web console is reachable from the network (port 9001 by default)","fix":"- Upgrade MinIO to a release newer than `RELEASE.2025-10-15T17-29-55Z`; the sources say this affected release line is no longer supported, so the fix is unknown\n- Restrict console access to trusted networks until a fixed build is in place","status":"open","published_at":"2026-10-20T15:17:19+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:12:29+00:00","updated_at":"2026-10-25T04:12:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:12:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MinIO to a release newer than `RELEASE.2025-10-15T17-29-55Z`; the sources say this affected release line is no longer supported, so the fix is unknown\n- Restrict console access to trusted networks until a fixed build is in place","reach":"network","title":"MinIO: hard-coded cryptographic key in embedded console session auth","impact":"high","summary":"MinIO releases up to RELEASE.2025-10-15T17-29-55Z use a hard-coded cryptographic key in the embedded console's session token authentication in cmd/common-main.go. An attacker who knows the key can likely forge session tokens and reach the console remotely.","category":"package","nicknames":[],"who_cares":["minio","self-hosted","object-storage"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker forges console sessions and gets administrative access to storage","analyst_note":"Confirm the affected key and whether a fixed or supported release exists; check the NVD entry and MinIO security advisories for a patch or mitigation.","how_to_check":"- Run `minio --version` and compare against `RELEASE.2025-10-15T17-29-55Z`\n- Check whether the embedded web console is reachable from the network (port 9001 by default)","needs_analyst":true,"not_affected_if":["managed-hosting","newer-release"],"who_is_affected":"Teams running self-hosted MinIO at or before RELEASE.2025-10-15T17-29-55Z with the embedded console exposed to a network. The sources say the affected versions are no longer maintained, so no upstream patch is confirmed. Managed object storage users are not affected by this build.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000645,"input_tokens":3386,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113466':14A,17A '-2026':13A,16A 'affect':77C,122C 'attack':49B,107C 'auth':11A 'authent':45B 'cmd/common-main.go':47B,84C 'code':4A,35B,98C 'compon':87C 'consol':9A,41B,62B,89C 'cryptograph':5A,36B,99C 'cve':12A,15A 'detect':69C 'disclos':113C 'embed':8A,40B,88C 'exploit':110C 'file':83C 'forg':56B 'function':79C 'globaldeploymentid/sessiontokenauthenticate':80C 'hard':3A,34B,97C 'hard-cod':2A,33B,96C 'host':25B 'issu':76C 'key':6A,37B,53B,100C 'know':51B 'launch':105C 'lead':92C 'like':55B 'longer':127C 'maintain':131C 'manipul':91C 'may':116C 'minio':1A,18B,26B,71C 'object':20B 'object-storag':19B 'packag':22B 'possibl':103C 'product':123C 'public':114C 'reach':60B 'releas':27B 'release.2025-10-15t17-29-55z':30B,74C 'remot':63B,108C 'secur':65C 'self':24B 'self-host':23B 'session':10A,43B,57B 'storag':21B 'support':128C 'token':44B,58B 'use':31B,94C,118C 'vulner':66C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted MinIO at or before RELEASE.2025-10-15T17-29-55Z with the embedded console exposed to a network. The sources say the affected versions are no longer maintained, so no upstream patch is confirmed. Managed object storage users are not affected by this build.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113466","severity":null,"published_at":"2026-10-20T15:17:19+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}