Authentication Bypass in MinIO Object Storage System

CVE-2026-41145

What is CVE-2026-41145?

An authentication bypass vulnerability in MinIO's object storage system allows users with a valid access key to write arbitrary objects to any bucket without needing the secret key or a valid cryptographic signature. This flaw exploits the 'STREAMING-UNSIGNED-PAYLOAD-TRAILER' code path, enabling attackers to perform malicious actions simply by knowing a valid access key. The vulnerability impacts every MinIO deployment, as it allows unauthorized users to leverage their permissions, making it critical for users to update to the latest version or apply necessary workarounds.

References