CVE-2023-27589 Minio vulnerable to denial of access by an admin privileged user for root credential

What is CVE-2023-27589?

CVE-2023-27589 is a medium-severity vulnerability in minio, published on 14 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

Weakness: CWE-269

Which versions are affected by CVE-2023-27589?

It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2023-27589?

No fix has been published for CVE-2023-27589 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27589 being exploited?

There is no known exploitation of CVE-2023-27589 in the wild and no public exploit code.

Other vulnerabilities in minio

• CVE-2023-28434 MinIO Security Feature Bypass Exploited High 8.8
• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9wfv-wmf7-6753.