https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:13:15.607792+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-11410 bdu:2024-11410 2026-10-02T17:13:15.612286+00:00 bdu:2024-11410 https://cve.radiocsirt.org/vuln/bit-minio-2024-55949 BIT-minio-2024-55949 — Privilege escalation in IAM import API in MinIO 2026-10-02T17:13:15.612323+00:00

Affected: Bitnami: minio

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

 https://cve.radiocsirt.org/vuln/euvd-2026-207197 EUVD-2026-207197 2026-10-02T17:13:15.612358+00:00 EUVD-2026-207197 https://cve.radiocsirt.org/vuln/fkie_cve-2024-55949 fkie_cve-2024-55949 2026-10-02T17:13:15.612372+00:00

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

 https://cve.radiocsirt.org/vuln/ghsa-cwq8-g58r-32hg GHSA-cwq8-g58r-32hg — MinIO vulnerable to privilege escalation in IAM import API 2026-10-02T17:13:15.612395+00:00

Affected: Go: github.com/minio/minio

### Impact Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f

### Patches ``` commit f246c9053f9603e610d98439799bdd2a6b293427 Author: Aditya Manthramurthy <donatello@users.noreply.github.com> Date: Wed Dec 11 18:09:40 2024 -0800

fix: Privilege escalation in IAM import API (#20756) This API had missing permissions checking, allowing a user to change their policy mapping by: 1. Craft iam-info.zip file: Update own user permission in user_mappings.json 2. Upload it via `mc admin cluster iam import nobody iam-info.zip` Here `nobody` can be a user with pretty much any kind of permission (but not anonymous) and this ends up working. Some more detailed steps - start from a fresh setup: ``` ./minio server /tmp/d{1...4} & mc alias set myminio http://localhost:9000 minioadmin minioadmin mc admin user add myminio nobody nobody123 mc admin policy attach myminio readwrite nobody nobody123 mc alias set nobody http://localhost:9000 nobody nobody123 mc admin cluster iam export myminio mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x cd /tmp/x unzip myminio-iam-info.zip echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \ iam-assets/user_mappings.json zip -r myminio-iam-info-updated.zip iam-assets/ mc admin cluster iam import nobody ./myminio-iam…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14603-1 openSUSE-SU-2024:14603-1 — govulncheck-vulndb-0.0.20241218T202206-1.1 on GA media 2026-10-02T17:13:15.612444+00:00

govulncheck-vulndb-0.0.20241218T202206-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3706 WID-SEC-W-2024-3706 — MinIO: Schwachstelle ermöglicht Privilegieneskalation 2026-10-02T17:13:15.612464+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MinIO ausnutzen, um seine Privilegien zu erhöhen.