SSH Key Authentication Bypass Vulnerability in MinIO Object Storage

CVE-2025-27414

Summary

A vulnerability exists in MinIO's object storage solution where an error in the evaluation of SSH key trust allows unauthorized access. This occurs when SFTP connections are configured with LDAP as an identity provider, and users lack the 'sshPublicKey' attribute in LDAP. Successfully exploiting this weakness permits attackers to perform any file operations permitted by the ACL policies associated with the affected LDAP user or their groups. To exploit this, specific conditions must be met, including a configured SFTP access setup and knowledge of an LDAP username without the required SSH key properties. The issue has been addressed in version 1.2.0.

References