CVE-2026-113466
Received Received - Intake

Hard-Coded Cryptographic Key in MinIO

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113466
EUVD
EUVD-2026-105033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a MinIO RELEASE.2025-10-15T17-29-55Z

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-320 Key Management Errors
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113466 is a vulnerability in MinIO that allows unauthenticated attackers to gain full administrative access. It involves three flaws: an information leak exposing the deploymentID, deterministic key derivation using the same deploymentID for encryption keys, and missing credential validation for session cookies. Attackers exploit this by leaking the deploymentID via an S3 Select request, forging a session cookie with root credentials, and gaining admin access without proper validation.

Detection Guidance

Check for public MinIO buckets with S3 Select enabled. Send an anonymous S3 Select request with invalid SQL to a bucket object and inspect error responses for deploymentID exposure. Example command: aws s3api select-object-content --bucket <bucket-name> --key <object-key> --expression 'SELECT * FROM s3object' --expression-type 'SQL' --input-serialization 'CSV' --output-serialization 'JSON'.

Impact Analysis

If you use MinIO with embedded Console and public buckets, attackers could gain full administrative control over your MinIO instance. They could list private buckets, download sensitive objects, create new buckets, and manage users and policies without authentication. This requires a public bucket with at least one object and knowledge of default root credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A breach could result in regulatory fines, legal liabilities, and reputational damage due to compromised confidentiality and integrity of stored information.

Mitigation Strategies

Upgrade MinIO to a patched version or disable the embedded Console if no longer supported. Remove public access to MinIO buckets and disable S3 Select API if not required. Rotate all credentials and review IAM policies for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart