CVE-2026-113466 PUBLISHED

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

• ZAST.AI (VulDB User) reporter

• VDB-422691 | MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
• VDB-422691 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-113466 | CVE Analysis and Report
• Submit #1004925 | MinIO <=RELEASE.2025-10-15T17-29-55Z Use of Hard-coded Cryptographic Key
• https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md

• Use of Hard-coded Cryptographic Key CWE
• Key Management Error CWE