{"id":"CVE-2026-122267","kind":"vulnerability","aliases":["CVE-2026-122267"],"related":[],"title":"MinIO: unsigned x-amz headers let presigned URLs read across buckets","description":"MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.","summary":"MinIO's Signature V4 check, before RELEASE.2026-09-22T19-25-18Z, accepts unsigned x-amz-* headers. An attacker holding a presigned PUT URL can escalate it into a read from another bucket.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","minio","s3-compatible-storage","self-hosted"],"not_affected_if":["fixed-release","no-presigned-urls"],"how_to_check":"- Check the running MinIO release, for example with `minio --version`, and compare it to `RELEASE.2026-09-22T19-25-18Z`.\n- Look for presigned URL use in applications that talk to MinIO.","fix":"- Move to MinIO `RELEASE.2026-09-22T19-25-18Z` or later.","status":"open","published_at":"2026-11-05T22:17:55+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:36+00:00","updated_at":"2026-11-05T22:46:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T22:46:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move to MinIO `RELEASE.2026-09-22T19-25-18Z` or later.","reach":"network","title":"MinIO: unsigned x-amz headers let presigned URLs read across buckets","impact":"medium","summary":"MinIO's Signature V4 check, before RELEASE.2026-09-22T19-25-18Z, accepts unsigned x-amz-* headers. An attacker holding a presigned PUT URL can escalate it into a read from another bucket.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["minio","self-hosted","s3-compatible-storage"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads objects from other buckets on the server","analyst_note":"Confirm whether the MinIO vendor advisory on github.com states the affected range and whether presigned URLs are required for exploitation.","how_to_check":"- Check the running MinIO release, for example with `minio --version`, and compare it to `RELEASE.2026-09-22T19-25-18Z`.\n- Look for presigned URL use in applications that talk to MinIO.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-release","no-presigned-urls"],"who_is_affected":"Any MinIO deployment older than RELEASE.2026-09-22T19-25-18Z that issues presigned PUT URLs is exposed. Deployments that do not hand out presigned URLs, or that are already on the fixed release, can skip it. The sources do not say whether a default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4229,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122267':15A,18A '-2026':14A,17A 'accept':35B,63C 'across':11A 'amz':5A,39B,67C 'anoth':55B 'attack':42B 'bucket':12A,56B,80C 'check':32B 'compat':23B 'cross':79C 'cross-bucket':78C 'cve':13A,16A 'escal':49B,75C 'header':6A,40B,68C 'hold':43B 'host':27B 'infrastructur':19B 'let':7A,69C 'minio':1A,20B,28B,57C 'presign':8A,45B,71C 'put':46B,72C 'read':10A,53B,81C 'release.2026-09-22t19-25-18z':34B,62C 's3':22B 's3-compatible-storage':21B 'self':26B 'self-host':25B 'signatur':30B,58C 'storag':24B 'unsign':2A,36B,64C 'url':9A,47B,73C 'v4':31B,59C 'verif':60C 'x':4A,38B,66C 'x-amz':3A,37B,65C","nicknames":[],"mitigations":[],"who_affected":"Any MinIO deployment older than RELEASE.2026-09-22T19-25-18Z that issues presigned PUT URLs is exposed. Deployments that do not hand out presigned URLs, or that are already on the fixed release, can skip it. The sources do not say whether a default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","minio","s3compatiblestorage","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T17:56:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"82cea9a6-e9e3-46fe-bdb0-3673de380178","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122267","severity":null,"published_at":"2026-11-05T22:17:55+00:00","modified_at":"2026-11-05T22:17:55+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null}],"documents":[{"id":81013,"url":"https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T17:56:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}