CVE-2026-97731
Received Received - Intake

Path Traversal in MinIO Object Storage

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: MITRE

Description
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97731
EUVD
EUVD-2026-86510

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
minio minio *
pgsty silo to 1233254:*:*:*:*:*:*:* (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MinIO allows an attacker with a presigned PUT URL for one object to add an unsigned x-amz-copy-source header to the request. This causes the server to perform a server-side copy of any object the signing key can read, effectively granting read access to all objects accessible by the key.

Detection Guidance

This vulnerability involves unsigned x-amz-* headers bypassing signature checks in MinIO/Silo. To detect it, inspect network traffic for requests with x-amz-copy-source or other x-amz-* headers not listed in the X-Amz-SignedHeaders field. Check MinIO server logs for unauthorized CopyObject operations or unexpected object access patterns.

Impact Analysis

If you use MinIO with presigned URLs or signed requests, an attacker could exploit this to read any object your credentials can access. This could lead to unauthorized data exposure, data theft, or compliance violations depending on the stored data.

Compliance Impact

This vulnerability could result in unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using MinIO may face compliance penalties if this vulnerability is exploited.

Mitigation Strategies

Upgrade MinIO to the latest patched version or apply the fix from pgsty/silo commit 1233254. Ensure all x-amz-* headers in requests are included in the X-Amz-SignedHeaders list. Monitor for unauthorized CopyObject operations and restrict access keys to least privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart