CVE-2026-41145— MinIO 授权问题漏洞
一分钟漏洞结论
影响对象
minio minio
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO存在授权问题漏洞，该漏洞源于STREAMING-UNSIGNED-PAYLOAD-TRAILER代码路径存在身份验证绕过，允许知道有效访问密钥的用户无需知道密钥或提供有效签名即可向任意存储桶写入对象。以下版本受到影响：RELEASE.2023-05-18T00-05-36Z至RELEASE.2026-04-11T03-20-12Z之前版本。
可能的 ATT&CK 技术 1 AI
T1078 · Valid Accounts
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-41145 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
来源: CVE Program / CVE List V5
Vulnerability Description
MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path
allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. `PutObjectHandler` and `PutObjectPartHandler` call `newUnsignedV4ChunkedReader` with a signature verification gate based solely on the presence of the `Authorization` header. Meanwhile, `isPutActionAllowed` extracts credentials from either the `Authorization` header or the
`X-Amz-Credential` query parameter, and trusts whichever it finds. An attacker omits the `Authorization` header and supplies credentials exclusively via the query string. The signature gate evaluates to `false`, `doesSignatureMatch` is never called, and the request proceeds with the permissions of the impersonated access key. This affects `PutObjectHandler` (standard and tables/warehouse bucket paths) and `PutObjectPartHandler` (multipart uploads). Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-04-11T03-20-12Z` or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` at the reverse proxy or WAF layer. Clients can use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER` (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit `s3:PutObject` grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
MinIO 授权问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO存在授权问题漏洞，该漏洞源于STREAMING-UNSIGNED-PAYLOAD-TRAILER代码路径存在身份验证绕过，允许知道有效访问密钥的用户无需知道密钥或提供有效签名即可向任意存储桶写入对象。以下版本受到影响：RELEASE.2023-05-18T00-05-36Z至RELEASE.2026-04-11T03-20-12Z之前版本。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-41145 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
default-local-qwen3.6
· 8720 chars
Pro+ 专属包含：
漏洞复现靶场录像（真实沙箱构建 + 触发，独家）
漏洞原理深度分析
触发条件与影响面
完整可执行 POC 代码
利用链与缓解建议
POC 打包下载
每月 100+ 条 AI 生成额度
三、漏洞 CVE-2026-41145 的情报信息
请登录查看更多情报信息。
CVE-2026-41145 补丁与修复 (1)
CVE-2026-41145 厂商安全公告 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-41145
暂无评论