| Title | MinIO <=RELEASE.2025-10-15T17-29-55Z Use of Hard-coded Cryptographic Key |
|---|
| Description | MinIO's embedded Console uses a symmetric encryption key derived via PBKDF2 to encrypt/decrypt session cookies. Both the passphrase and salt for this PBKDF2 derivation are set to globalDeploymentID (a UUID), which is leaked to unauthenticated users through S3 Select API error responses. An attacker who obtains the deploymentID can compute the exact encryption key, forge a valid Console session cookie containing root credentials, and gain full administrative access to the MinIO instance.
The vulnerability is a combination of three flaws:
Information Leak — S3 Select ParseSelectFailure errors return globalDeploymentID() as the <HostId> value, whereas standard S3 API errors use a safe SHA256(nodeName) hash.
Deterministic Key Derivation — cmd/common-main.go sets both CONSOLE_PBKDF_PASSPHRASE and CONSOLE_PBKDF_SALT to the same leaked deploymentID, making the session cookie encryption key fully computable.
Missing Credential Validation — SessionTokenAuthenticate() only checks whether the cookie can be decrypted; it does not validate the claimed STS credentials against the MinIO server. Successful decryption equals successful authentication.
|
|---|
| Source | ⚠️ https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md |
|---|
| User | ZAST.AI (UID 87884) |
|---|
| Submission | 09/29/2026 11:25 (24 days ago) |
|---|
| Moderation | 10/20/2026 10:03 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422691 [MinIO up to RELEASE.2025-10-15T17-29-55Z Embedded Console cmd/common-main.go globalDeploymentID/SessionTokenAuthenticate hard-coded key] |
|---|
| Points | 20 |
|---|