CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.

• CWE-269
• CWE-863

• https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abfPatch, Third Party Advisory
• https://github.com/minio/minio/pull/13976Patch, Third Party Advisory
• https://github.com/minio/minio/pull/7949Patch, Third Party Advisory
• https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18ZRelease Notes, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cxPatch, Third Party Advisory
• https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abfPatch, Third Party Advisory
• https://github.com/minio/minio/pull/13976Patch, Third Party Advisory
• https://github.com/minio/minio/pull/7949Patch, Third Party Advisory
• https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18ZRelease Notes, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cxPatch, Third Party Advisory

Published

Dec 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43852OroPlatform is a PHP Business Application Platform. In affec…8.8
• CVE-2021-43853Ajax.NET Professional (AjaxPro) is an AJAX framework availab…5.4
• CVE-2021-43854NLTK (Natural Language Toolkit) is a suite of open source Py…7.5
• CVE-2021-43855Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and …5.4
• CVE-2021-43856Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and …5.4
• CVE-2021-43857Gerapy is a distributed crawler management framework. Gerapy…8.8
• CVE-2021-43859XStream is an open source java library to serialize objects …7.5
• CVE-2021-4386The WP Security Question plugin for WordPress is vulnerable …4.3
• CVE-2021-43860Flatpak is a Linux application sandboxing and distribution f…8.6
• CVE-2021-43861Mermaid is a Javascript based diagramming and charting tool …5.4
• CVE-2021-43862jQuery Terminal Emulator is a plugin for creating command li…5.4
• CVE-2021-43863The Nextcloud Android app is the Android client for Nextclou…7.5