Security Advisories

This ledger summarizes fork-specific security fixes and closely related upgrade-impacting security notes in pgsty/silo. It is intentionally narrower than a changelog and focuses on release-impacting security behavior. Each advisory with its own investigation also has an article in the Security Chronicle; this page is the stable index of identifiers, fixes, and release boundaries.

Entries carry a CVE identifier where one exists. Where none does, they carry a fork-local SN-<year>-<sequence> identifier so that a finding without a CVE can still be referenced stably from release notes, commits and issues. An SN- identifier is not a CVE and is not registered in any vulnerability database; it is deliberately not written in CVE form so that scanners do not mistake it for one. Upstream minio/minio is archived, so for findings in inherited code there is no upstream maintainer to coordinate a CVE assignment with. SN-2026-001 is the streaming-flush regression in trackingResponseWriter, which is a reliability defect rather than a security one and is tracked in the release notes rather than here.

Current release boundary

Verified 2026-09-16. The latest published Server is RELEASE.2026-09-03T13-18-01Z. SN-2026-011 is fixed on main but remains present in that release and all earlier public Server releases. A newer mcli, pkg or standalone Console does not patch an installed Server. See the component matrix for source pins.

Inherited upstream advisory baseline

The first Silo community release was cut from upstream history that already contained the following security fix. Upstream and Silo links are both recorded even when the fork preserves the same commit object and SHA; that identity is the inheritance evidence, not a claim that Silo independently reimplemented the patch.

Advisories since RELEASE.2026-03-21T00-00-00Z

Upgrade and compatibility notes for each entry follow. Entries whose full investigation is told in a chronicle article are summarized here; follow the link for the threat model, rejected alternatives, and verification.

CVE-2026-33322 — OIDC STS JWT algorithm confusion

Remote exploitation: yes. Closes JWT algorithm confusion by removing HMAC/shared-secret verification and requiring JWKS-backed verifier keys. Breaking change: providers issuing HS256, HS384, or HS512 tokens for these STS flows must switch to JWKS-backed RSA or ECDSA signing before upgrading. PS256 and EdDSA are not currently supported.

CVE-2026-33419 — LDAP STS username enumeration

Remote exploitation: yes. Prevents username enumeration by unifying unknown-user and bad-password responses (both now 400 InvalidParameterValue) and adds in-memory login throttling. The final June design limits by source IP only; it removed the shared username bucket because attackers could use it to lock out a specific account. Limits are per-node and in-memory; the source address trust policy is configurable separately. See the LDAP STS chronicle for the successive repairs.

CVE-2026-34204 — replication metadata injection

Remote exploitation: yes. Blocks untrusted X-Minio-Replication-* headers from being smuggled into internal replication metadata and leaving objects unreadable. Upgrade any server that accepts untrusted PutObject or CopyObject requests, which in practice means almost any production server that accepts writes.

CVE-2026-39414 — S3 Select oversized records

Remote exploitation: yes. Rejects oversized CSV and line-delimited JSON records with OverMaxRecordSize instead of buffering them unchecked. The April fix initially missed the SIMD JSON path; the June follow-up routes all JSON Lines through the bounded json.PReader, closing that bypass. See the S3 Select chronicle.

CVE-2026-41145 — unsigned-trailer authentication bypass

Remote exploitation: yes. Closes the query-string authentication bypass in unsigned-trailer streaming requests. Upgrade if clients can reach object write endpoints using the STREAMING-UNSIGNED-PAYLOAD-TRAILER content-sha256 mode together with query-string SigV4 credentials.

CVE-2026-40344 — Snowball auto-extract authentication

Remote exploitation: yes. Verifies request authentication before tar extraction in Snowball unsigned-trailer flows. Upgrade if you use PutObjectExtract or Snowball uploads.

CVE-2026-42600 — internode ReadMultiple path traversal

Remote exploitation: yes; cluster-root JWT required. Removes the unused endpoint that allowed path traversal outside configured drive roots. Upgrade distributed-erasure deployments. Single-node deployments do not register this route.

SN-2026-002 — internode payload containment

Remote exploitation: yes; cluster-root / internode JWT required. Completes CVE-2026-42600: its fix removed one endpoint that exercised the gap; the gap itself — request bodies and grid frames never reaching the validity middleware, and no containment in the storage layer — remained across three further protocol surfaces. Closes path traversal on both the volume and path axes (including the peer-S3 bucket RPCs, which bypass the storage-REST wrapper entirely), an unrecoverable divide-by-zero that killed a node per RPC frame, metadata that reported truncated shards as intact, and three allocations sized from caller-declared values. Upgrade distributed-erasure deployments; single-node deployments register none of these routes. No S3 API behaviour changes; object keys containing . or .. path segments were already refused at the S3 boundary.

SN-2026-003 — policy condition value sources

Remote exploitation: yes (policy-dependent). Prevents raw request entries that spell condition-key names from shadowing or synthesizing internal condition values; confines s3:signatureAge to verified SigV4 presigned requests; separates query-only list fields from header-backed x-amz-* fields; and stops client request tags from impersonating stored existing-object tags. The compatible query form remains for storage class and upload tagging on handlers that consume it; an explicitly present header wins, including an empty header. Use request-tag conditions only on operations that consume tags. Header-only x-amz-* policy keys no longer accept query substitutes. See condition value sources and precedence.

Client source address trust — opt-in hardening, not a vulnerability

Fixed by fe6dc4780; no CVE assigned (the default matches upstream, and upstream’s own position is that IP-based restrictions are impractical without reliable source-IP visibility). Adds an enforceable forwarded-header trust boundary, MINIO_API_TRUSTED_PROXIES. Set to a list of addresses or CIDR blocks, forwarded headers are believed only from those peers and forwarding chains are read right-to-left past listed hops — which also stops the client-supplied left-most entry that an appending proxy leaves in place. Set to none, no forwarded header is believed at all. This is the guarantee _MINIO_API_XFF_HEADER=off never provided. No behaviour change for any existing deployment; the variable is opt-in and inert when unset. If you use IpAddress or NotIpAddress conditions, note that they were not enforceable before this change; the operator contract — including why the allowlist must name proxies rather than subnets and why multi-node deployments must include their own node addresses — is in the chronicle article and the settings reference.

SN-2026-004 — object-grant bucket reach

Remote exploitation: yes (policy-dependent). Withholds twelve sensitive bucket-level writes from an object-only resource pattern (arn:aws:s3:::bucket/*): PutBucketPolicy, DeleteBucketPolicy, PutBucketObjectLockConfiguration, PutBucketVersioning, PutReplicationConfiguration, PutBucketLifecycle, DeleteBucket, ForceDeleteBucket, PutBucketCors, DeleteBucketCors, PutBucketQOS, PutInventoryConfiguration. This is an authorization tightening; read the chronicle article before upgrading if you write your own bucket-scoped policies. Add the bare bucket ARN (arn:aws:s3:::bucket) alongside the wildcard form in any statement that legitimately grants one of the twelve. Built-in canned policies are unaffected; Deny statements and NotResource exclusions are untouched. MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on restores the historical behaviour in full; it is read once at startup.

SN-2026-005 — bare ARN prefix rejection

No direct remote exploit; policy-dependent. Rejects S3, S3 Tables, and KMS ARN namespace prefixes that name no resource, including their historical *arn:... serialization, in both Resource and NotResource, when creating named policies and when creating or updating service-account session policies. Existing policies keep loading, matching, importing, and replicating with unchanged runtime behavior, but a policy containing such a prefix cannot be submitted unchanged; replace it with the intended concrete resource, or use an explicit wildcard such as arn:aws:s3:::* only when all resources are intended. A “bare ARN prefix” (arn:aws:s3:::) is distinct from the valid “bare bucket ARN” of SN-2026-004 (arn:aws:s3:::bucket). IAM import, site-replication receive paths, stored-policy loading, and STS inline policies remain on the permissive compatibility path in this release. See the pkg v3.12.0 release note.

SN-2026-006 — SSE-C zero-byte reads

Remote exploitation: yes; requires read access to the object. Zero-byte SSE-C objects never unsealed the customer-provided key, so a wrong key was accepted with 200 instead of 403, and a copy or new version could be created under a key of the caller’s choosing without knowing the current one. Wrong keys now fail with 403 AccessDenied as on AWS; correct keys behave as before and no client change is needed. Inherited from upstream; every earlier release is affected.

SN-2026-007 — GetObjectAttributes on SSE-C objects

Remote exploitation: yes; requires read access to the object. Attributes of SSE-C objects were returned without authenticating the customer key, and a bare X-Minio-Source-Replication-Request header skipped the check entirely. A wrong key returns 403, a replication marker without the key returns 400; replication peers holding s3:ReplicateObject are unaffected. Inherited from upstream.

SN-2026-008 — internal replication headers

Remote exploitation: yes; any authenticated principal that can read or write the object. Completes CVE-2026-34204: internal headers such as X-Minio-Source-Etag, X-Minio-Source-Mtime, X-Minio-Source-Replication-Request, the replication SSE key headers, and X-Amz-Bucket-Replication-Status were still trusted on presence in most handlers. Replication semantics now require the exact marker value together with s3:ReplicateObject or s3:ReplicateDelete; other requests have these headers removed after signature verification. Site replication service accounts and bucket-replication targets that already hold the replication permissions are unaffected. Inherited from upstream.

SN-2026-009 — user/group status authorization

Remote exploitation: yes; authenticated admin API. Status changes were authorized against admin:EnableUser / admin:EnableGroup regardless of the requested status, so a principal allowed only to enable could also disable, and vice versa. Enable and disable now require the action matching the target status. Policies that grant only one of the pair lose the other operation; admin:* and the built-in consoleAdmin policy are unaffected. Inherited from upstream.

SN-2026-010 — explicit version delete authorization

Remote exploitation: yes; authenticated S3 API. Explicit version deletes were authorized as s3:DeleteObject with only a deny check on s3:DeleteObjectVersion, diverging from AWS. Explicit version deletes now require s3:DeleteObjectVersion. Two policy effects: principals granted only s3:DeleteObject can no longer delete specific versions, and a policy that relied on Deny s3:DeleteObject to block permanent deletes must also deny s3:DeleteObjectVersion, because Allow s3:* now permits explicit version deletes. Replication targets keep the s3:ReplicateDelete contract. Inherited from upstream.

SN-2026-011 — unsigned x-amz-* headers and x-amz-copy-source

Remote exploitation: yes; a party holding only a presigned PUT URL, or any signed PUT, needs no credentials of its own. SigV4 verification only checked that each named signed header was present and never inspected the x-amz-* headers that actually arrived, while the router dispatches any PUT carrying x-amz-copy-source to CopyObjectHandler. An unsigned x-amz-copy-source therefore turned a one-object write grant into a server-side copy of any object the signing key can read, executed as the signer; both the presigned and Authorization-header paths were affected, and where the destination bucket allows anonymous GetObject the copied private bytes become readable unauthenticated. Any unsigned x-amz-* request header is now refused with AccessDenied on both paths, matching AWS S3 (AWS returns 403; Silo returns 400 AccessDenied, otherwise identical). Every AWS SDK, minio-go, and mc already signs its x-amz-* headers, so legitimate clients need no change. Inherited unchanged from upstream minio/minio; every earlier release, including the latest published Server 20260903, is affected. Reported by Oren Yomtov; a CVE has been requested. See the chronicle article and the signed-header design record.

Dependency security updates

Rows list the absorbed fix and the commit or release that first carried it. Reachability and deployment exposure still need to be judged per release: an absorbed dependency fix is not a claim that the vulnerability was reachable in Silo.

Operationally significant security-related fixes

Attribution of this ledger

This page is maintained from the ledger previously carried in the repository at docs/security/advisories.md, updated through verified main 40220bd836cb (2026-09-16). Release status statements are calibrated against the component matrix; each fix’s investigation, review, and verification detail lives in the linked chronicle article or release note.