Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-28434

CVE-2023-28434HIGH

MinIO is vulnerable to privilege escalation on Linux/MacOS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0792   94.6   YES

AFFECTED
  Product  Versions                          Fixed
  minio    < RELEASE.2023-03-20T20-16-18Z –  —

TIMELINE
  Mar 15  Reserved by GitHub_M
  Mar 22  Published (CNA: GitHub_M)
  Sep 19  Added to CISA KEV, remediation due 2023-10-10

CWE-269 · CNA: GitHub_M · CVSS v3.1 · 4 references · KEV due October 10, 2023

Description

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 15, 2023	Reserved	Reserved by GitHub_M
March 22, 2023	Published	Published (CNA: GitHub_M)
September 19, 2023	KEV ADDED	Added to CISA KEV, remediation due 2023-10-10

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
minio	minio	—	< RELEASE.2023-03-20T20-16-18Z	—

Weaknesses

CWE-269

References (4)

https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 [x_refsource_MISC]
https://github.com/minio/minio/pull/16849 [x_refsource_MISC]
https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c [x_refsource_CONFIRM]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434 [government-resource]

Authoritative record: CVE-2023-28434 at cve.org

Vendors: minio

Weaknesses: CWE-269

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-28434 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.