Authentication Bypass in MinIO Object Storage

CVE-2026-40344

What is CVE-2026-40344?

MinIO's object storage system is affected by a vulnerability that allows users with valid access keys to write arbitrary objects to any bucket without secret key verification. This flaw arises from the mishandling of the PutObjectExtractHandler, which fails to check cryptographic signatures for a new authentication type introduced in an earlier update. Consequently, an attacker can exploit this vulnerability by sending unauthorized PUT requests, potentially compromising the integrity of stored data. Users are urged to upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later and to consider implementing security measures such as blocking unsigned-trailer requests at load balancers.

References