MinIO, an object storage system, had a flaw in extractMetadataFromMime() that allowed any authenticated user with s3:PutObject permission to inject server-side encryption (SSE) metadata into objects by sending specially crafted X-Minio-Replication-* headers on a normal PutObject request. The injection could cause objects to be inadvertently encrypted or stored with incorrect metadata, potentially leading to data integrity or confidentiality issues.

The vulnerability affects the MinIO product. All installations running a version older than RELEASE.2026-03-26T21-24-40Z are vulnerable. The issue applies to any deployments that grant s3:PutObject permissions to authenticated users.

The CVSS base score is 7.1 and the EPSS score is below 1 percent, indicating a moderate to high severity but a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog. The attack requires legitimate S3 authentication and the ability to send custom headers with a PutObject request, so it is limited to users who already have upload permissions. The flaw permits the injection of internal server‑side encryption metadata, which could alter data handling and violate integrity or confidentiality.