High-Severity Authentication Bypass Discovered in MinIO Storage

A critical vulnerability (CVSS 8.8) in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows attackers who possess a valid access key to bypass signature verification by omitting the Authorization header and supplying credentials via X-Amz-Credential, enabling unauthorized object writes (including multipart uploads). The flaw affects open-source releases since May 2023 and is resolved in MinIO AIStor RELEASE.2026-04-11T03-20-12Z; mitigations include immediate upgrade, WAF/reverse-proxy filtering for X-Amz-Content-Sha256:STREAMING-UNSIGNED-PAYLOAD-TRAILER, and tightening s3:PutObject permissions.