CVE-2021-41266: MinIO Operator Console authentication bypass with external IDP enabled

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, high EPSS, and an exploit-tagged reference make this an urgent fix despite no KEV listing.

What it is

MinIO Operator Console versions 0.12.2 and earlier contain a missing-authentication flaw (CWE-306) that allows an authentication bypass when an external identity provider is enabled. Because the console is the administrative GUI for the MinIO operator, bypassing its authentication exposes a critical management function. The issue is fixed in 0.12.3 and later.

Impact

An unauthenticated attacker gains access to the Operator Console with the privileges it holds, which can include full read and write control over the MinIO deployment and its Kubernetes resources. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reachable over the network (AV:N) with no privileges and no user interaction (PR:N, UI:N), but only when an external identity provider is configured via the CONSOLE_IDP_* environment variables. Deployments using only the Kubernetes service account token are not affected.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.48 (98.8th percentile), and the referenced GitHub pull request is tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade MinIO Operator Console to 0.12.3 or newer.
• If upgrade is not possible, set automountServiceAccountToken: false on the operator-console deployment so no service account token is mounted in the pod.
• Disable external identity provider authentication by unsetting CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK, and use the Kubernetes service account token instead.
• Restrict network access to the Operator Console so it is not reachable from untrusted networks.
• Audit console access logs for unauthenticated or unexpected administrative activity.

Detection

• Review Operator Console access logs for requests that succeed without a valid IDP authentication flow.
• Alert on console administrative actions (user, policy, bucket or tenant changes) originating from unexpected source IPs or sessions.
• Monitor Kubernetes audit logs for operator-console pod activity that does not correlate with a legitimate authenticated session.
• Check deployments for the CONSOLE_IDP_* environment variables to identify systems still exposed to this condition.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.