Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .8396 99.7 YES
AFFECTED Product Versions Fixed minio >= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z – —
TIMELINE Mar 15 Reserved by GitHub_M Mar 22 Published (CNA: GitHub_M) Apr 21 Added to CISA KEV, remediation due 2023-05-12
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
| Date | Event | Detail |
|---|---|---|
| March 15, 2023 | Reserved | Reserved by GitHub_M |
| March 22, 2023 | Published | Published (CNA: GitHub_M) |
| April 21, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-05-12 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| minio | minio | — | >= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z | — |
Authoritative record: CVE-2023-28432 at cve.org
Vendors: minio
Weaknesses: CWE-200
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-28432 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
