CVE-2026-34204
published 2026-03-31CVE-2026-34204: MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated…
PriorityP338high7.1CVSS 3.1
AVNACLPRLUINSUCNILAH
EPSS
0.12%
2.1th percentile
MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request. This issue has been patched in version RELEASE.2026-03-26T21-24-40Z.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | minio_minio | 0.0.0-20240328174456-468a9fae83e9 – 0.0.0-20260212201848-7aac2a2c5b7c | — |
| github.com | minio_minio | >= 0.0.0-20240328174456-468a9fae83e9 | — |
| minio | minio | < RELEASE.2026-03-26T21-24-40Z | RELEASE.2026-03-26T21-24-40Z |
| minio | minio | < 2026-03-26t21-24-40z | 2026-03-26t21-24-40z |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MinIO up to RELEASE.2025-10-15T17-29-55Z extractMetadataFromMime improper authentication (GHSA-3rh2-v3gr-35p9)
vuldb·2026-07-25·CVSS 7.1
CVE-2026-34204 [HIGH] MinIO up to RELEASE.2025-10-15T17-29-55Z extractMetadataFromMime improper authentication (GHSA-3rh2-v3gr-35p9)
A vulnerability has been found in MinIO and classified as critical. Affected by this vulnerability is the function extractMetadataFromMime. The manipulation leads to improper authentication.
This vulnerability is uniquely identified as CVE-2026-34204. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
OSV
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
osv·2026-04-02
CVE-2026-34204 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
GHSA
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
ghsa·2026-03-27
CVE-2026-34204 [HIGH] CWE-287 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
## Impact
_What kind of vulnerability is it? Who is impacted?_
A flaw in `extractMetadataFromMime()` allows any authenticated user with `s3:PutObject` permission to inject internal server-side encryption metadata into objects by sending crafted `X-Minio-Replication-*` headers on a normal PutObject request. The server unconditionally maps these headers to `X-Minio-Internal-*` encryption metadata without verifying that the request is a legitimate replication request. Objects written this way carry bogus encryption keys and become **permanently unreadable** through the S3 API.
Any authenticated user or service with `s3:PutObject` permission on any bucket can make objects permanently unreadable by injecting fake SSE encr
OSV
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
osv·2026-03-27
CVE-2026-34204 [HIGH] MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
## Impact
_What kind of vulnerability is it? Who is impacted?_
A flaw in `extractMetadataFromMime()` allows any authenticated user with `s3:PutObject` permission to inject internal server-side encryption metadata into objects by sending crafted `X-Minio-Replication-*` headers on a normal PutObject request. The server unconditionally maps these headers to `X-Minio-Internal-*` encryption metadata without verifying that the request is a legitimate replication request. Objects written this way carry bogus encryption keys and become **permanently unreadable** through the S3 API.
Any authenticated user or service with `s3:PutObject` permission on any bucket can make objects permanently unreadable by injecting fake SSE encr
No detection rules found.
No public exploits indexed.
2026-03-31
Published