CVE-2026-122267 · Infrastructure
NO FIX YET · SEE WHAT TO DO
MinIO's Signature V4 check, before RELEASE.2026-09-22T19-25-18Z, accepts unsigned x-amz-* headers. An attacker holding a presigned PUT URL can escalate it into a read from another bucket.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any MinIO deployment older than RELEASE.2026-09-22T19-25-18Z that issues presigned PUT URLs is exposed. Deployments that do not hand out presigned URLs, or that are already on the fixed release, can skip it. The sources do not say whether a default configuration is affected.
Not affected if fixed-release, no-presigned-urls
Who cares minio, s3-compatible-storage, self-hosted
minio --version, and compare it to RELEASE.2026-09-22T19-25-18Z.RELEASE.2026-09-22T19-25-18Z or later.MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.