Back to search
CVE-2026-34204
Published: Mar 31, 2026
Modified: Apr 1, 2026
PUBLISHED
Description
MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request. This issue has been patched in version RELEASE.2026-03-26T21-24-40Z.
| Vendor | Product | Versions |
|---|---|---|
minio | minio | affected < RELEASE.2026-03-26T21-24-40Z |
Weaknesses (CWE)
References
https://github.com/minio/minio/security/advisories/GHSA-3rh2-v3gr-35p9
x_refsource_CONFIRM
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now