CVE-2025-32963CWE-522

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

Medium · published April 22, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-04-22T17:14Z
EPSS history
Timeline
  • 22 APR 17:14Z
    Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
    cvelistv5