CVE-2025-32963 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
Attackers can replay Kubernetes service account tokens to other internal systems due to missing audience scoping in MinIO Operator STS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32963?
CVE-2025-32963 is a medium-severity vulnerability in minio operator, published on 22 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.
Weakness: CWE-522
Which versions are affected by CVE-2025-32963?
3 open source packages ship an affected version, including github.com/minio/operator.
| Package | Affected | Fixed in |
|---|---|---|
github.com/minio/operator Go | All versions | None |
github.com/minio/operator Go | All versions | 7.1.0 |
github.com/minio/operator Go | All versions | 7.1.0 |
How do I fix CVE-2025-32963?
Upgrade github.com/minio/operator to 7.1.0 or later.
Is CVE-2025-32963 being exploited?
There is no known exploitation of CVE-2025-32963 in the wild and no public exploit code.
Sources
Also known as GHSA-7m6v-q233-q9j9, GO-2025-3637.