CVE-2023-28432: MinIO cluster deployment leaks environment variables including root credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-accessible disclosure of root credentials in a widely deployed storage platform, listed in CISA KEV with very high EPSS and observed exploitation activity.

What it is

In MinIO distributed cluster deployments from RELEASE.2019-12-17T23-16-33Z up to RELEASE.2023-03-20T20-16-18Z, the server returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. This exposes administrative credentials for the object storage cluster, which is a serious risk for any distributed deployment.

Impact

An unauthenticated attacker obtains the MinIO root password and secret key, gaining full administrative control over the object storage cluster and its data. This can lead to data theft, tampering, or destruction of stored objects.

Attack surface

Reachable over the network via the MinIO API with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Only distributed (cluster) deployments in the affected release range are impacted.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-04-21, and EPSS gives a 30-day probability of 0.83957 (99.7th percentile). A vendor advisory reference is tagged Exploit, and GreyNoise tracks active MinIO information disclosure attempts.

What to do

• Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later immediately.
• If immediate upgrade is not possible, restrict network access to the MinIO API to trusted sources only.
• Rotate MINIO_ROOT_PASSWORD and MINIO_SECRET_KEY after patching, since credentials may already be exposed.
• Review MinIO audit and access logs for unauthorized administrative activity.
• Verify no MinIO cluster deployments remain on releases before RELEASE.2023-03-20T20-16-18Z.

Detection

• Monitor network traffic and logs for requests to MinIO endpoints that return environment variable data.
• Use the GreyNoise tag 'minio-information-disclosure-attempt' to identify scanning or exploitation attempts against your IP space.
• Alert on MinIO administrative actions or API calls from unexpected source IPs following credential exposure.
• Search for MinIO versions in the affected release range across your environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.