Path Traversal Vulnerability in MinIO Object Storage

CVE-2026-42600

What is CVE-2026-42600?

A path traversal vulnerability exists in MinIO's ReadMultiple internode storage-REST endpoint. This flaw allows an authenticated attacker, with access to the cluster root JWT, to read files located outside the designated drive roots. By sending a specially crafted POST request to the minio/storage/{drivePath}/v63/rmpl endpoint, the attacker can incorporate '../' sequences in the Bucket field of the msgpack-encoded body. The MinIO server then improperly opens the specified path, returning its content within the msgpack response, thereby exposing sensitive file data. This security issue is resolved in the version released on April 14, 2026.

References