High · published October 17, 2025
⚡ Service accounts with a sneaky loophole! If you're using MinIO, a vulnerability allows restricted accounts to create new accounts without the usual limits — like a kid getting into the candy jar when no one’s looking! 🍬 Imagine a library where a user can check out any book they want, even if they were only allowed to read at the kids' section. This vulnerability lets miscreants bypass restrictions and access data they shouldn't, just like that sneaky library patron who's suddenly in the adult section! An attacker could exploit this oversight to create unrestricted service accounts, gaining access to sensitive data stored in buckets and objects. They could modify, delete, or even create new objects beyond their intended permissions — a recipe for chaos!
Imagine a library where a user can check out any book they want, even if they were only allowed to read at the kids' section. This vulnerability lets miscreants bypass restrictions and access data they shouldn't, just like that sneaky library patron who's suddenly in the adult section! This privilege escalation vulnerability in MinIO allows service accounts and STS accounts with restricted session policies to bypass their inline policy restrictions due to flawed IAM policy validation logic.
An attacker could exploit this oversight to create unrestricted service accounts, gaining access to sensitive data stored in buckets and objects. They could modify, delete, or even create new objects beyond their intended permissions — a recipe for chaos! Patch to version RELEASE.2025-10-15T17-29-55Z immediately to close this loophole. Review and audit your IAM policies to ensure restricted access is enforced properly post-update. Don’t forget to monitor account activities for any suspicious actions! You’ve got this! Secure your MinIO environment and keep your data protected! 🛡️