CVE-2026-40344

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.

• CWE-287
• CWE-306

• https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091Patch
• https://github.com/minio/minio/pull/16484Issue Tracking
• https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237Patch, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40338libgphoto2 is a camera access and control library. Versions …5.2
• CVE-2026-40339libgphoto2 is a camera access and control library. Versions …5.2
• CVE-2026-40340libgphoto2 is a camera access and control library. Versions …6.1
• CVE-2026-40341libgphoto2 is a camera access and control library. In versio…3.5
• CVE-2026-40342Firebird is an open-source relational database management sy…9.9
• CVE-2026-40343free5GC UDR is the user data repository (UDR) for free5GC, a…5.8
• CVE-2026-40346NocoBase is an AI-powered no-code/low-code platform for buil…6.5
• CVE-2026-40347Python-Multipart is a streaming multipart parser for Python.…5.3
• CVE-2026-40348Movary is a self hosted web app to track and rate a user's w…7.7
• CVE-2026-40349Movary is a self hosted web app to track and rate a user's w…8.8
• CVE-2026-4035A vulnerability in mlflow/mlflow versions prior to 3.11.0 al…7.7
• CVE-2026-40350Movary is a self hosted web app to track and rate a user's w…8.8