CVE-2026-97731 Security feature bypass in MinIO
Attackers can bypass signature verification to perform unauthorized server-side copies, reading data beyond the presigned URL's scope.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97731?
CVE-2026-97731 is a high-severity vulnerability in MinIO, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.
Weakness: CWE-347
Which versions are affected by CVE-2026-97731?
How do I fix CVE-2026-97731?
No fix has been published for CVE-2026-97731 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-97731 being exploited?
There is no known exploitation of CVE-2026-97731 in the wild and no public exploit code.
Sources
Also known as GHSA-r7wh-x6rf-8g63.