Authentication Bypass in MinIO Allows Arbitrary Object Writes

Executive Summary

This vulnerability affects MinIO, a high-performance object storage system. It is an authentication bypass in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path that allows any user who knows a valid access key to write arbitrary objects to any bucket without needing the secret key or a valid cryptographic signature.

The issue arises because the system trusts credentials provided either in the Authorization header or the X-Amz-Credential query parameter. An attacker can omit the Authorization header and supply credentials only via the query string, bypassing signature verification and gaining write access with just the access key.

This affects handlers responsible for object uploads, allowing unauthorized writes to buckets. The vulnerability impacts all MinIO deployments starting from RELEASE.2023-05-18T00-05-36Z up to but not including RELEASE.2026-04-11T03-20-12Z.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves requests containing the header 'X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER'. Detection can focus on identifying such requests in your network traffic or logs.

You can monitor HTTP requests to your MinIO deployment for the presence of the 'X-Amz-Content-Sha256' header with the value 'STREAMING-UNSIGNED-PAYLOAD-TRAILER'.

For example, using command-line tools like tcpdump or tshark to capture traffic and grep or similar tools to filter for this header might help detect exploit attempts.

• Use tcpdump to capture HTTP traffic on port 9000 (default MinIO port): tcpdump -A -s 0 'tcp port 9000' | grep 'X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER'
• Check MinIO server access logs for requests containing 'X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with only a valid access key to write arbitrary objects to any bucket in a MinIO deployment without needing the secret key or a valid signature.

This means unauthorized data can be uploaded, potentially leading to data corruption, unauthorized data injection, or storage abuse.

Since the attack requires only WRITE permission, any user with such permission can exploit this flaw, increasing the risk of unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with only a valid access key to write arbitrary objects to any bucket without needing the secret key or a valid cryptographic signature. This unauthorized write access could lead to data integrity and confidentiality issues.

Such unauthorized access and potential data manipulation or injection could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and confidentiality.

Organizations using affected MinIO versions might face increased risk of non-compliance due to the inability to fully enforce access controls and protect sensitive data from unauthorized modification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade MinIO to RELEASE.2026-04-11T03-20-12Z or later.

If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer or reverse proxy by rejecting any request containing the header 'X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER'.

Clients should use the signed variant 'STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER' instead.

Alternatively, restrict WRITE permissions by limiting 's3:PutObject' grants to trusted principals, although this does not fully eliminate the vulnerability.

Useful 0 Not Useful 0