CVE-2023-28434: MinIO metadata bucket name check bypass allows object write to any bucket

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a network-reachable privilege bypass with high confidentiality, integrity and availability impact, confirmed exploited in CISA KEV, though it requires valid credentials and Console API access.

What it is

MinIO before RELEASE.2023-03-20T20-16-18Z fails to properly validate the metadata bucket name when processing PostPolicyBucket, letting crafted requests place an object into any bucket. Because the flaw is a security feature bypass in a widely deployed object storage service, it can undermine bucket isolation and access controls. It is listed in CISA KEV, so real-world exploitation is confirmed.

Impact

An attacker with credentials carrying arn:aws:s3:::* permission can write objects into buckets they should not be able to reach, breaking tenant and bucket isolation and potentially planting or overwriting data.

Attack surface

Reached over the network through the MinIO Console API, which must be enabled; the attacker needs valid credentials with broad S3 permissions and no user interaction is required.

Exploitation

CISA added it to KEV on 2023-09-19 with a 2023-10-10 remediation due date, and a public exploit-tagged pull request exists; EPSS 30-day probability is about 7.9 percent (94th percentile).

What to do

• Upgrade to MinIO RELEASE.2023-03-20T20-16-18Z or later.
• If patching is delayed, enable browser API access and do not run with MINIO_BROWSER=off, per the vendor workaround.
• Audit and reduce credentials holding arn:aws:s3:::* permission, applying least privilege to S3 policies.
• Restrict network access to the MinIO Console API to trusted management networks.
• Review bucket contents and access logs for unexpected object writes.

Detection

• Monitor MinIO audit and Console API logs for PostPolicyBucket requests that write to buckets outside the caller's expected scope.
• Alert on object PUT or POST events where the target bucket does not match the credential's normal usage pattern.
• Track use of credentials with arn:aws:s3:::* permission and flag any activity from them.
• Compare bucket inventories against known baselines to spot newly created or modified objects.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.