Security/CVE: Privilege Escalation via Session Policy Bypass
A privilege escalation vulnerability in Service Accounts and STS was reported and fixed. All users are advised to upgrade immediately to this security release.
Security
A CVE was reported Privilege Escalation via Session Policy Bypass in Service Accounts and STS and fixed in this release,
All users are advised to download and upgrade their MinIO setup immediately.
To install the latest release
go install -v github.com/minio/minio@latest
OR
go install -v github.com/minio/minio@RELEASE.2025-10-15T17-29-55Z
For container environments, please clone the source and build the latest container.
git clone https://github.com/minio/minio
git checkout RELEASE.2025-10-15T17-29-55Z
TAG=myregistry.com/minio/minio:RELEASE.2025-10-15T17-29-55Z make docker
What's Changed
- fix: remove unnecessary replication checks by @0xMALVEE in #21569
- LDAP TLS handshake fails with StartTLS and tls_skip_verify=off by @mosesdd in #21582
- fix: incorrect poolID when after decommission adding pools by @jiuker in #21590
- fix: after saveRebalanceStats cancel will be empty by @jiuker in #21597
- Use new gofumpt by @klauspost in #21613
- fix: timeN function return final closure not be called by @drivebyer in #21615
- Updating readme for MinIO docs by @ravindk89 in #21625
- Update README with Docker and Helm installation instructions by @ravindk89 in #21627
- Bump Go version in toolchain directive to 1.24.8 by @marktheunissen in #21629
- fix: allow trailing slash in AWS S3 POST policies by @cduzer in #21612
- Change documentation link in README by @ravindk89 in #21636
- fix: check sub-policy properly when present by @donatello in #21642
New Contributors
Full Changelog: RELEASE.2025-09-07T16-13-09Z...RELEASE.2025-10-15T17-29-55Z
Source: original entry ↗
More from MinIO
Follow MinIO to get its new changes in your feed and email digest.
Security and bug fix release
This release addresses security vulnerability CVE-2025-31489 and includes multiple bug fixes, dependency updates, and improvements including JWT dependency bumps, template fixes, STS token revocation API, and various stability enhancements across the codebase.
Bugfix Release
Fixed decommissioning to ignore orphan delete markers during verification and corrected ILM scanning to properly handle objects with only free versions.
Bugfix Release
Multiple bug fixes and dependency updates including corrections to buffered streams, error handling, KMS credentials support, and security patches for Go libraries. Upgraded to Go 1.24 and improved batch expiry job reporting.