CVE-2023-28434VulnerabilityPublished 09/19/2023Updated 10/24/2026
CVE-2023-28434: MinIO Security Feature Bypass Vulnerability
Affects MinIO MinIOSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/19/2023
- KEV deadline
- 10/10/2023
- EPSS
- 7.9% chance of exploitation in 30 days – higher than 94% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.