Verified

osv:BIT-MINIO-2026-34204: Affected product not specified by the source

MinIO is Vulnerable to SSE Metadata Injection via Replication Headers.

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

Any authenticated user with s3:PutObject permission can inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request.

Published 13-Oct-2026 07:27 UTC

KEV: no

Provenance

OSV.dev · Source record · observed 2026-10-08 08:57:13.774521+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-osv-bit-minio-2026-34204.html