CVE-2026-40344

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40344", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T22:50:01.358Z", "datePublished": "2026-04-22T00:49:30.137Z", "dateUpdated": "2026-04-22T18:10:58.947Z"}, "containers": {"cna": {"title": "MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237"}, {"name": "https://github.com/minio/minio/pull/16484", "tags": ["x_refsource_MISC"], "url": "https://github.com/minio/minio/pull/16484"}, {"name": "https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091", "tags": ["x_refsource_MISC"], "url": "https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091"}], "affected": [{"vendor": "minio", "product": "minio", "versions": [{"version": ">= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T00:49:30.137Z"}, "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key."}], "source": {"advisory": "GHSA-9c4q-hq6p-c237", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T17:54:45.957595Z", "id": "CVE-2026-40344", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:10:58.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40344", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:54:45.957595Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:08:24.943Z"}}], "cna": {"title": "MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads", "source": {"advisory": "GHSA-9c4q-hq6p-c237", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "minio", "product": "minio", "versions": [{"status": "affected", "version": ">= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z"}]}], "references": [{"url": "https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237", "name": "https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/minio/minio/pull/16484", "name": "https://github.com/minio/minio/pull/16484", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091", "name": "https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T00:49:30.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40344", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:10:58.947Z", "dateReserved": "2026-04-10T22:50:01.358Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-22T00:49:30.137Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "minio", "vendor": "minio", "versions": [{"status": "affected", "version": ">= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*", "matchCriteriaId": "C63B131C-F150-4741-9A5B-181A55DE20B8", "versionEndExcluding": "2026-04-11T03-20-12Z", "versionStartIncluding": "2023-05-18t00-05-36z", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key."}, {"lang": "es", "value": "MinIO es un sistema de almacenamiento de objetos de alto rendimiento. A partir de RELEASE.2023-05-18T00-05-36Z y antes de RELEASE.2026-04-11T03-20-12Z, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el gestor de autoextracci\u00f3n Snowball de MinIO (\u2019PutObjectExtractHandler\u2019) permite a cualquier usuario que conozca una clave de acceso v\u00e1lida escribir objetos arbitrarios en cualquier bucket sin conocer la clave secreta o proporcionar una firma criptogr\u00e1fica v\u00e1lida. Cualquier despliegue de MinIO est\u00e1 afectado. El ataque requiere solo una clave de acceso v\u00e1lida (el valor predeterminado conocido \u2019minioadmin\u2019, o cualquier clave con permiso de ESCRITURA en un bucket) y un nombre de bucket de destino. Cuando se a\u00f1adi\u00f3 el soporte para \u2019authTypeStreamingUnsignedTrailer\u2019, el nuevo tipo de autenticaci\u00f3n se manej\u00f3 en \u2019PutObjectHandler\u2019 y \u2019PutObjectPartHandler\u2019 pero nunca se a\u00f1adi\u00f3 a \u2019PutObjectExtractHandler\u2019. El bloque \u2019switch rAuthType\u2019 del gestor de autoextracci\u00f3n snowball no tiene un caso para \u2019authTypeStreamingUnsignedTrailer\u2019, por lo que la ejecuci\u00f3n contin\u00faa sin verificaci\u00f3n de firma. La llamada \u2019isPutActionAllowed\u2019 antes del switch extrae la clave de acceso y verifica los permisos de IAM, pero no verifica la firma criptogr\u00e1fica. Un atacante env\u00eda una solicitud PUT con \u2019X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER\u2019, \u2019X-Amz-Meta-Snowball-Auto-Extract: true\u2019, y un encabezado \u2019Authorization\u2019 que contiene una clave de acceso v\u00e1lida con una firma completamente fabricada. La solicitud es aceptada y la carga \u00fatil tar se extrae en el bucket. Los usuarios del proyecto de c\u00f3digo abierto minio/minio deber\u00edan actualizar a MinIO AIStor RELEASE.2026-04-11T03-20-12Z o posterior. Si la actualizaci\u00f3n no es posible de inmediato, bloquee las solicitudes de tr\u00e1iler sin firmar en el balanceador de carga. Rechace cualquier solicitud que contenga X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER en el proxy inverso o la capa WAF. Los clientes pueden usar STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (la variante firmada) en su lugar. Alternativamente, restrinja los permisos de ESCRITURA. Limite las concesiones s3:PutObject a principales de confianza. Si bien esto reduce la superficie de ataque, no elimina la vulnerabilidad ya que cualquier usuario con permiso de ESCRITURA puede explotarla con solo su clave de acceso."}], "id": "CVE-2026-40344", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40344", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T17:54:45.957595Z", "version": "2.0.3"}}]}, "published": "2026-04-22T01:16:05.430", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/minio/minio/pull/16484"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[RELEASE.2023-05-18T00-05-36Z,RELEASE.2026-04-11T03-20-12Z)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "minio", "source": "cna", "vendor": "minio"}, "product": "minio", "vendor": "minio"}], "analysis": {"en": {"generated_at": "2026-04-22T06:08:39.735776+00:00", "value": {"mitigation_remediation": ["Upgrade MinIO to RELEASE.2026-04-11T03-20-12Z or a later release.", "If an upgrade is not possible, configure your load balancer or reverse proxy to reject requests that include X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER.", "Restrict write permissions by limiting s3:PutObject grants to trusted principals only."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Object Write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all MinIO deployments running the open\u2011source minio/minio product between RELEASE.2023-05-18T00-05-36Z and just before RELEASE.2026-04-11T03-20-12Z. Earlier releases before 2023-05-18 are not affected. Any installation that has not applied the April\u202f2026 update is vulnerable, including those using the default minioadmin credentials or any user with WRITE permissions on a bucket.", "description_and_impact": "MinIO's Snowball auto\u2011extract handler, PutObjectExtractHandler, contains an authentication bypass that allows any user who has a valid access key to upload arbitrary objects to any bucket. The bug stems from a missing signature check when the auth type is streaming unsigned trailer. An attacker can craft a PUT request with a forged signature, include X\u2011Amz\u2011Content\u2011Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER and the Snowball\u2011Auto\u2011Extract metadata flag, and the request is accepted and the payload is extracted into the target bucket. This flaw permits unauthorized data insertion and potential overwriting of existing objects, compromising the integrity of stored data and is classified as CWE\u2011287 and CWE\u2011306.", "risk_and_exploitability": "The CVSS score is 8.8, indicating a high\u2011severity defect that can lead to unrestricted write access. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the risk remains high because the attack requires only a valid access key and a bucket name, which are often known or default credentials exist. An attacker can trigger the flaw remotely by sending a crafted PUT request to the S3 endpoint; no privileged local access is needed. This makes the vulnerability a high\u2011risk remote attack vector."}}}}, "created": "2026-04-22T03:30:06.537042+00:00", "updated": "2026-04-22T06:15:10.412899+00:00", "vendors": ["minio", "minio$PRODUCT$minio"]}