🚨 NEW MINIO FLAW CAN TURN LIMITED PRESIGNED WRITE ACCESS INTO BROADER DATA READ ACCESS A newly published vulnerability in MinIO is worth attention for organizations running S3-compatible object storage. Tracked as: CVE-2026-97731 CVSS: 7.1 HIGH The issue concerns AWS Signature Version 4 header validation. According to the published CVE record, MinIO does not ensure that every incoming x-amz-* header is included in the request's signed-header list. The result? An attacker holding a presigned PUT URL for one object may be able to add an x-amz-copy-source header. MinIO can then perform the copy using the permissions of the identity that originally signed the URL. In certain scenarios: Permission to write one object could become access to copy/read other objects accessible to the signer. Amazon S3 rejects the equivalent request. 🧠 Why this matters: Presigned URLs are deliberately used to grant narrow, temporary permissions. A vulnerability that expands what such a URL can authorize undermines the security assumption behind the entire delegation mechanism. Source: CVE/MITRE data via CVEKit · NVD/ENISA enrichment.
