CVE-2021-41137

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

• CWE-285

• https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbdPatch, Third Party Advisory
• https://github.com/minio/minio/pull/13388Patch, Third Party Advisory
• https://github.com/minio/minio/pull/13422Patch, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577cThird Party Advisory
• https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbdPatch, Third Party Advisory
• https://github.com/minio/minio/pull/13388Patch, Third Party Advisory
• https://github.com/minio/minio/pull/13422Patch, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577cThird Party Advisory

Published

Oct 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41131python-tuf is a Python reference implementation of The Updat…8.7
• CVE-2021-41132OMERO.web provides a web based client and plugin infrastruct…6.1
• CVE-2021-41133Flatpak is a system for building, distributing, and running …7.8
• CVE-2021-41134nbdime provides tools for diffing and merging of Jupyter Not…5.4
• CVE-2021-41135The Cosmos-SDK is a framework for building blockchain applic…6.5
• CVE-2021-41136Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior …3.7
• CVE-2021-41138Frontier is Substrate's Ethereum compatibility layer. In the…5.3
• CVE-2021-41139Anuko Time Tracker is an open source, web-based time trackin…6.1
• CVE-2021-4114Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41140Discourse-reactions is a plugin for the Discourse platform t…5.3
• CVE-2021-41141PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2021-41142Tuleap Open ALM is a libre and open source tool for end to e…5.4