CVE-2023-28432

KEVMinIO Information Disclosure Vulnerability

Description

MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

PublishedMar 22, 2023

Last modifiedJun 17, 2026

Added to KEVApr 21, 2023

Remediation dueMay 12, 2023

References

github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18ZRelease Notes
github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3qExploitVendor Advisory
twitter.com/Andrew___Morris/status/1639325397241278464Third Party Advisory
viz.greynoise.io/tag/minio-information-disclosure-attemptThird Party Advisory
greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-cleanThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1264 days
CVSS: 7.5 HIGH
EPSS (30-day exploit probability): 84.0% · top 1% of all CVEs
Weakness: CWE-200
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.