CVE-2025-31489
MinIO performs incomplete signature validation for unsigned-trailer uploads
Impact
### Impact This is a high priority vulnerability and users must upgrade ASAP. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket, Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via `curl` ### Patches Yes https://github.com/minio/minio/pull/21103 ### Workarounds Reject requests with `x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` for now at LB layer, ask application users to use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER`
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/minio/minio | < 0.0.0-20250403145552-8c70975283f9 | 0.0.0-20250403145552-8c70975283f9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/minio/minio/pull/21103
- https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh
- https://github.com/advisories/GHSA-wg47-6jq2-q2hh
- https://nvd.nist.gov/vuln/detail/CVE-2025-31489
- https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519