CVEvulnerability
CVE-2021-41137
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-10-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-285
Description
Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.
Affected configurations
• minio minio 2021-10-10t16-53-30z
Related
Weakness · CWE (1)
- CWE-285 Improper Authorization weakness
References
- https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbd Patch, Third Party Advisory
- https://github.com/minio/minio/pull/13388 Patch, Third Party Advisory
- https://github.com/minio/minio/pull/13422 Patch, Third Party Advisory
- https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c Third Party Advisory
- https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbd Patch, Third Party Advisory
- https://github.com/minio/minio/pull/13388 Patch, Third Party Advisory
- https://github.com/minio/minio/pull/13422 Patch, Third Party Advisory
- https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c Third Party Advisory