CVE-2023-28432

Name: CVE-2023-28432
Creator: NVD / NIST
Published: 2023-03-22T21:15:18.257+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10Actively ExploitedEPSS 83.96%

Last modified Jun 17, 2026

CVE-2023-28432 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. CISA has confirmed active exploitation in the wild. EPSS estimates a 83.96% chance of exploitation in the next 30 days.

Description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

83.96%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by May 12, 2023.

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Minio	Minio	>= 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z

References

https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18ZRelease Notes
https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3qExploit, Vendor Advisory
https://twitter.com/Andrew___Morris/status/1639325397241278464Third Party Advisory
https://viz.greynoise.io/tag/minio-information-disclosure-attemptThird Party Advisory
https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-cleanThird Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18ZRelease Notes
https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3qExploit, Vendor Advisory
https://twitter.com/Andrew___Morris/status/1639325397241278464Third Party Advisory
https://viz.greynoise.io/tag/minio-information-disclosure-attemptThird Party Advisory
https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-cleanThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432US Government Resource

Timeline

Published: Mar 22, 2023
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2023-28432?

How severe is CVE-2023-28432?

CVE-2023-28432 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 83.96% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2023-28432?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-28432?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST