What’s Vulnerable › Vulnerabilities

CVE-2023-27589: Minio vulnerable to denial of access by an admin privileged user for root credential

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-14 · updated 2026-06-17
• Weakness: CWE-269

Description

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

Affected products

• minio: from 2020-12-23t02-24-12z before 2023-03-13t19-46-17z — fixed in 2023-03-13t19-46-17z

How to fix

Upgrade to a fixed version: minio 2023-03-13t19-46-17z. Check the vendor advisory for mitigations.

References

• https://github.com/minio/minio/pull/16803
• https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753
• https://github.com/minio/minio/pull/16803
• https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753

Get alerted when CVE-2023-27589 or the next vulnerability affects your stack