CVE-2026-34204 PUBLISHED

MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

Assigner: GitHub_M
Reserved: 26.03.2026 Published: 31.03.2026 Updated: 01.04.2026

MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request. This issue has been patched in version RELEASE.2026-03-26T21-24-40Z.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	minio
Product	minio
Versions	Version < RELEASE.2026-03-26T21-24-40Z is affected

References

https://github.com/minio/minio/security/advisories/GHSA-3rh2-v3gr-35p9

Problem Types

CWE-287: Improper Authentication CWE