MinIO’s streaming unsigned‑payload‑trailer implementation permits an attacker who knows any valid access key, including the default minioadmin key, to write arbitrary objects to any bucket without having the corresponding secret key or a valid cryptographic signature. The flaw originates from a signature validation gate that checks only for the presence of an Authorization header; when the header is omitted and credentials are supplied through the X‑Amz‑Credential query parameter, the gate bypasses verification and the request proceeds with the privileges of the impersonated key. This authentication bypass (CWE‑287) enables unauthenticated object writes, potentially compromising data integrity and availability.

All deployments of the open‑source minio/minio product are affected, from the earliest release up to and including RELEASE.2026‑04‑11T03‑20‑12Z. Any MinIO instance that accepts STREAMING‑UNSIGNED‑PAYLOAD‑TRAILER uploads is impacted, regardless of the specific bucket. Users running the default admin credentials or any access key with WRITE permission on a bucket can exploit the vulnerability.

The CVSS score of 8.8 indicates high severity, and the KEV status is not listed, implying no confirmed exploitation in the wild yet. The EPSS score is not available, so the current likelihood remains uncertain, yet an attacker only requires a valid access key, a common default, and the target bucket name—conditions that are frequently satisfied in many MinIO deployments. The vulnerability can be leveraged by anyone with a legitimate key, allowing them to overwrite or create objects, potentially leading to data corruption, unauthorized storage, or denial of service. A patch exists in the MinIO AIStor RELEASE.2026‑04‑11T03‑20‑12Z, but until it is applied, the risk is substantial.