An authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user with a valid access key to write arbitrary objects to any bucket without needing the secret key or a valid signature. This affects all MinIO releases from RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-02-12T20-18-48Z. The flaw arises because signature verification is bypassed when credentials are supplied via query string without the Authorization header. A fix is available in MinIO AIStor RELEASE.2026-04-11T03-20-12Z. Users unable to upgrade immediately should block unsigned-trailer requests at the load balancer.