MinIO’s Signature V4 verification before the release dated 2026‑09‑22T19‑25‑18Z accepts unsigned x‑amz‑* headers, allowing an attacker who can generate or obtain a presigned PUT URL to manipulate the request. This flaw lets the server treat the operation as a legitimate read from another bucket, resulting in unauthorized access to data stored in that bucket. The vulnerability is a form of header injection (CWE‑347).

All Chainguard MinIO deployments prior to RELEASE.2026‑09‑22T19‑25‑18Z are affected; newer releases are not impacted. No further version granularity is provided.

The CVSS score of 8.8 signals a high‑severity flaw. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation reports exist. The likely attack vector is remote, exploiting the presigned URL mechanism, and requires only the ability to obtain a presigned PUT URL with unsigned x‑amz‑* headers. No official workaround is available, making immediate application of the patch essential.