CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113466?
CVE-2026-113466 is a medium-severity vulnerability in MinIO, published on 20 Oct 2026.
Official description
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Which versions are affected by CVE-2026-113466?
How do I fix CVE-2026-113466?
No fix has been published for CVE-2026-113466 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113466 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113466 exists.
Sources
Also known as GHSA-q95x-chg5-qwqh.