CVE-2026-97731

Name of the Vulnerable Software and Affected Versions MinIO versions prior to 7aac2a2 pgsty/silo versions prior to 1233254

Description MinIO fails to verify that every x-amz-* header in a request is included in the client-supplied X-Amz-SignedHeaders list. The extractSignedHeaders() function in cmd/signature-v4-utils.go only iterates through the claimed list and does not enumerate the headers that actually arrived. Consequently, an unsigned header is neither hashed into the canonical request nor rejected. Since cmd/api-router.go dispatches the CopyObject operation based solely on the presence of the x-amz-copy-source header, an attacker with a presigned PUT URL for a single object can add this header to the URL. This allows the server to perform a server-side copy of any object the signing key can read, effectively turning limited write access into broad read access across all buckets reachable by that key.

Recommendations Update MinIO to a version later than 7aac2a2. Update pgsty/silo to a version later than 1233254.