Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

MinIO admin API allows actions without full credentials

CVE-2020-11012 · published 6 years ago
Summary

Versions of MinIO released before April 23, 2020 let someone with only the admin access key run admin functions, such as creating new service accounts, without needing the admin secret key. This could let an attacker gain higher‑level control of your storage system. Upgrade to the version released on April 23, 2020 or later to close the gap.

What to do
  • Update minio to version 2020.04.23.
  • Update minio minio to version 2020-04-23t00-58-49z or later.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – minio < 2020.04.23
Fix: upgrade to 2020.04.23
– minio minio < 2020-04-23t00-58-49z
cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
Original advisory text
Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-305Authentication Bypass by Primary Weakness
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published23 Apr 2020
Updated3 Nov 2026
First seen13 Mar 2026
Sources
CVE-2020-11012 · OSV
GHSA-xv4r-vccv-mg4w · GHSA
CVE-2020-11012 · NVD
BIT-minio-2020-11012 · OSV
Track software like this
Free during beta