CVE-2023-28432: MinIO information disclosure that leaks admin credentials
The short version: MinIO is an S3-compatible object-storage server. In clustered deployments, CVE-2023-28432 lets an unauthenticated request pull back all of the server's environment variables — including MINIO_ROOT_USER and MINIO_ROOT_PASSWORD. On paper it's "just" information disclosure; in practice it can hand over the keys to the whole object store. It's in CISA's KEV catalog. If your MinIO is below the March 2023 release, patch and rotate. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — an information leak that discloses administrator credentials (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~83.96% · 99.66th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-05-12 |
| Known exploited? | Yes — observed exploitation and mass scanning |
| Vulnerability type | CWE-200 exposure of sensitive information → disclosure of root credentials → object-store takeover |
| Requires authenticated session? | No — unauthenticated |
| Affected | Cluster deployments from RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z |
| Fixed in | RELEASE.2023-03-20T20-16-18Z (and later) |
What you need to know
MinIO stores objects — files, backups, artifacts — behind an S3-compatible API. In a clustered deployment, CVE-2023-28432 causes an endpoint to return the process environment to an unauthenticated caller. That environment routinely includes the credentials MinIO was started with, so the "information" being disclosed is often the root user and password for the store itself.
That's why the practical severity outruns the mechanical read of the base score, much like a session-token leak behaves like an authentication bypass:
- It's unauthenticated and network-reachable. One request, no login.
- What leaks is the admin credential. With root access an attacker can read and modify every bucket — and MinIO's admin surface can be leveraged further from there.
- It's KEV-listed and was actively scanned. Exposed, unpatched instances were found and hit at scale.
How serious we see it
High — and honestly on the edge of Critical when the leaked credentials are live.
NVD scores it 7.5 as a confidentiality-only issue. We agree with the mechanics and disagree with the impression it leaves: leaking the root password of an internet-facing data store is, for practical purposes, a path to full compromise of that store. The bounded, reassuring part is that it affects a defined release window in clustered deployments, the fix is published, and exposure is quick to determine — but patching alone doesn't undo a credential that already leaked, so rotate.
Recommendations
- Patch now. Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later.
- Rotate credentials — don't skip this. Assume
MINIO_ROOT_PASSWORDand any other secrets in the environment were exposed; change them after upgrading. - Hunt. Review access logs for anomalous administrative actions and unexpected bucket reads or writes.
- Reduce exposure. Keep the MinIO console and API off the public internet where possible; restrict to trusted networks.
- Confirm your exposure first. Verify whether you run an internet-facing MinIO cluster and which release.
How BreachRisk sees it
BreachRisk discovers internet-facing MinIO consoles and endpoints from little more than your domain, fingerprints the release, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV and because a credential-leaking data store deserves priority over a generic "information disclosure." We detect and prioritize the exposed, affected instance; the outside-in view means it was already on your radar.