MinIO servers that have not yet been updated to the commit 7aac2a2 allow an attacker to add an unsigned X‑Amz‑Copy‑Source header to a presigned PUT URL. Because the signature verification routine iterates only over the list of signed headers, the unsignatured header is never validated, hashed, or rejected. The API router interprets the request as a CopyObject operation, which creates a server‑side copy of an arbitrary object if the signing key has read permissions to that object. Thus the attacker can read and duplicate any object that the signing key is allowed to read, effectively giving them read access to all buckets reachable by that key. This results in a data breach and potentially unauthorized data exposure.

The vulnerability affects MinIO releases prior to commit 7aac2a2, as well as the pgsty/silo repository before 1233254. The affected vendor is MinIO, and the affected product is the MinIO storage server.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with access to a presigned PUT URL. By appending an unsigned X‑Amz‑Copy‑Source header, the attacker can trigger a server‑side copy as the signer, obtaining a copy of any object the signing key is permitted to read. Without patching, the risk is that legitimate users’ presigned URLs could be abused to export sensitive data beyond the intended scope.