CVE-2026-97731 MinIO CVE debrief

Who should care

Defenders responsible for MinIO installations, security teams monitoring for suspicious activity, and administrators of systems using presigned URLs should be aware of this vulnerability and take necessary actions to prevent potential unauthorized access and data breaches.

Why it matters

CVE-2026-97731 is a high-severity vulnerability in MinIO that allows an attacker to manipulate presigned URLs, potentially leading to unauthorized access and data exposure. Defenders should prioritize verifying and updating MinIO installations, monitoring for suspicious activity, and taking necessary actions to prevent potential breaches.

• Potential unauthorized access to sensitive data via manipulated presigned URLs
• Possible data exposure due to server-side copy of objects without proper authorization
• Need for verification and updates to MinIO installations to prevent exploitation
• Importance of monitoring for suspicious activity related to presigned URLs and unauthorized access attempts

Technical summary

The vulnerability in MinIO allows an attacker to manipulate presigned URLs by adding an x-amz-copy-source header, potentially leading to unauthorized access and data exposure. This is caused by MinIO not verifying that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. The issue arises because MinIO dispatches CopyObject on the presence of x-amz-copy-source alone, allowing a holder of a presigned PUT URL scoped to a single object to add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects

Defensive priority

Defenders should prioritize verifying and updating MinIO installations to prevent potential unauthorized access and data breaches.

Recommended defensive actions

• Verify MinIO installations for potential vulnerability to CVE-2026-97731
• Update MinIO to a version that properly verifies signed headers in requests
• Monitor for suspicious activity related to presigned URLs and unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by MinIO not verifying that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. This allows an attacker to add an x-amz-copy-source header to a presigned PUT URL, causing a server-side copy of any object the signing key can read.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.