https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:30:33.897584+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-01131 bdu:2024-01131 2026-10-03T04:30:33.978267+00:00 bdu:2024-01131 https://cve.radiocsirt.org/vuln/bit-minio-2024-24747 BIT-minio-2024-24747 — MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation 2026-10-03T04:30:33.978303+00:00

Affected: Bitnami: minio

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-vk24562 CLEANSTART-2026-VK24562 — Security fix for CVE-2024-24747 applied in: minio 0.20240131.202033-r0 2026-10-03T04:30:33.978337+00:00

Affected: CleanStart: minio

Security vulnerability affects the minio package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-4127 EUVD-2026-4127 2026-10-03T04:30:33.978358+00:00 EUVD-2026-4127 https://cve.radiocsirt.org/vuln/fkie_cve-2024-24747 fkie_cve-2024-24747 2026-10-03T04:30:33.978370+00:00

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

 https://cve.radiocsirt.org/vuln/ghsa-xx8w-mq23-29g4 GHSA-xx8w-mq23-29g4 — Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation 2026-10-03T04:30:33.978392+00:00

Affected: Go: github.com/minio/minio

### Summary When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive.

Credit to @xSke for sort of accidentally discovering this. I only understood the implications.

### Details / PoC We spun up the latest version of minio in a docker container and signed in to the admin UI using the minio root user. We created two buckets, `public` and `private` and created an access key called `mycat` and attached the following policy to only allow access to the bucket called `public`.

```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::public", "arn:aws:s3:::public/*" ] } ] } ``` We then set an alias in mc: `mcli alias set vuln http://localhost:9001 mycat mycatiscute`

And checked whether policy works: ``` A ~/c/minio-vuln mcli ls vuln [0001-01-01 00:53:28 LMT] 0B public/ ``` Looks good, we believe this is how 99% of users will work with access policies.

If I now create a file `full-access-policy.json`: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::*" ] } ] } ``` And…

 https://cve.radiocsirt.org/vuln/gsd-2024-24747 gsd-2024-24747 2026-10-03T04:30:33.978438+00:00 gsd-2024-24747