MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket read

Impact

MinIO is a common object store behind training datasets, checkpoints and model registries on GPU fleets. Signature V4 verification before RELEASE.2026-09-22T19-25-18Z does not cover x-amz-* headers that were not signed, so anyone holding a single narrow presigned PUT URL can add headers that turn the request into a read of objects in another bucket. On a shared cluster that breaks the tenant boundary the bucket policy was supposed to enforce: a presigned upload URL handed to a job, a notebook user or an external party becomes a way to pull datasets or checkpoints belonging to someone else. Presigned URLs are routinely passed around and logged, so the credential needed is one an operator does not think of as sensitive.

Who can reach it

Anyone who obtains a presigned PUT URL for the MinIO endpoint - no MinIO account or further authentication needed. Network reach to the S3 endpoint is enough.

What to do

Upgrade MinIO to RELEASE.2026-09-22T19-25-18Z or later and restart the server processes; on a distributed deployment this is a rolling restart of each MinIO node, no host reboot. Until then, treat outstanding presigned URLs as broader than intended - shorten expiries and re-issue any long-lived ones. GPU nodes do not need draining.

References

Related entries

• Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
• Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
• NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
• Apache CloudStack: an account user registering a KVM template executes arbitrary code on the KVM hostsCVE-2026-25077 · Apache CloudStack (KVM template registration, direct-download file name handling)High
• Apache Airflow: documented BashOperator pattern lets a UI user inject commands onto the worker via dag_run.confCVE-2026-30898 · Apache Airflow BashOperator documentation example (dag_run.conf templating)High
• Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller canCVE-2026-33001 · Jenkins controller (.tar/.tar.gz extraction, symlink handling)High