MinIO Vulnerability Allows Info Disclosure and Security Bypass

CERT-Bund has released a critical security advisory (WID-SEC-2026-0812) concerning MinIO, an S3-compatible object storage solution used for large-scale AI/ML, Data Lake, and database workloads. The advisory details a vulnerability that allows remote, anonymous attackers to exploit MinIO to disclose information and bypass security controls. The vulnerability has a CVSS Base Score of 9.1 (critical) and a Temporal Score of 7.9 (high). The affected product is Open Source MinIO, specifically versions prior to RELEASE.2026-03-17T21-25-16Z, running on Linux and UNIX operating systems.

Organizations utilizing MinIO, particularly those handling sensitive data or critical workloads, must immediately review and apply available mitigations to address this critical vulnerability. Failure to do so could result in significant data breaches and compromise of system security. The advisory indicates that mitigations are available, and users should consult the provided links for specific instructions and version history. The advisory was published on March 22, 2026, with an update on March 23, 2026.