CVE-2020-11012

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2020-04-23T00-58-49Z

Description The issue allows for an authentication bypass in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations, such as creating new service accounts for existing access keys, without knowing the admin secret key.

Recommendations For versions prior to RELEASE.2020-04-23T00-58-49Z, update to version RELEASE.2020-04-23T00-58-49Z or later to resolve the issue. As a temporary workaround, consider restricting access to the MinIO admin API to minimize the risk of exploitation.