CVE DatabaseCVE-2023-28432

Updated 2026-06-17한국어 권고문 →

CVE-2023-284327.5/HIGHCISA KEVCWE-200

MinIO Distributed Deployment Information Disclosure and Credential Leakage Vulnerability (CVE-2023-28432) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

minio

Affected Components

minio

Published Date

2023-03-22

CVSS v3.1

7.5

HIGH

EPSS (30d)

84.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

MinIO distributed (cluster) deployments starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z

Impact

Unauthenticated remote attackers can retrieve all system environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, leading to complete compromise of the storage cluster

Mitigation

Immediately upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, and rotate all potentially exposed root credentials immediately

Affected Products & Version Scope

All MinIO distributed deployments from RELEASE.2019-12-17T23-16-33Z up to (but excluding) RELEASE.2023-03-20T20-16-18Z

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Immediately upgrade your MinIO instances to the patched release (RELEASE.2023-03-20T20-16-18Z or later).

bash

# 1. Check current MinIO version
minio --version

# 2. Upgrade MinIO binary directly (for internet-connected environments)
mc admin update play
# Or download and replace with the secure release binary
wget https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2023-03-20T20-16-18Z -O /usr/local/bin/minio
chmod +x /usr/local/bin/minio
systemctl restart minio

2. Temporary Workaround & Hardening Configuration

If an immediate upgrade is not feasible, restrict external access to the vulnerable bootstrap endpoints using a reverse proxy or firewall rules.

nginx

# Nginx configuration to block external access to the bootstrap API
server {
    listen 80;
    server_name minio.example.com;

    location /minio/bootstrap/ {
        deny all;
        return 403;
    }

    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

3. Log Audit & IoC Verification Commands

Inspect access logs for unauthorized requests targeting the bootstrap endpoint and verify the running container configurations.

bash

# 1. Search access logs for exploitation attempts targeting the bootstrap endpoint
grep -i '/minio/bootstrap' /var/log/nginx/access.log

# 2. Identify running MinIO containers and verify their image tags
docker ps --filter 'ancestor=minio/minio' --format '{{.ID}}: {{.Image}}'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Datadog Cloud & Kubernetes Security

Due to active exploitation in the wild (CISA KEV), immediately upgrade MinIO to the patched version and rotate all root credentials.

Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet

Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.

Real-Time Production Container CVE Mapping

Start 14-Day Free Cloud Security Trial

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-28432) is a critical information disclosure (CWE-200) flaw in MinIO, a multi-cloud object storage framework, specifically affecting distributed cluster deployments. The root cause lies in a cluster administration API endpoint that fails to perform proper authorization checks before returning system information. Consequently, the endpoint exposes all environment variables defined in the MinIO process, including highly sensitive administrative credentials such as MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the unauthenticated cluster bootstrap endpoint (specifically /minio/bootstrap/v1/verify). Because this endpoint does not validate the requester's identity or permissions, it processes the request and returns a JSON payload containing the node's bootstrap configuration and all environment variables. The attacker extracts the root credentials from this response and uses them to authenticate as an administrator via the MinIO Console or API.

3. Infrastructure & Business Impact

With its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog and an EPSS score of 0.8396 (83.96%), this vulnerability is actively exploited in the wild. Successful exploitation grants full administrative access to the object storage, allowing attackers to exfiltrate, modify, or delete critical business data, backups, and sensitive customer information. Furthermore, compromised storage credentials can be leveraged for lateral movement within the cloud infrastructure, posing a severe threat to overall business continuity.

Official Vendor Advisories & References

NVD Original English Description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z

Source: security-advisories@github.com · Release Notes

https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q

Source: security-advisories@github.com · Exploit, Vendor Advisory

https://twitter.com/Andrew___Morris/status/1639325397241278464

Source: security-advisories@github.com · Third Party Advisory

https://viz.greynoise.io/tag/minio-information-disclosure-attempt

Source: security-advisories@github.com · Third Party Advisory

https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean

Source: security-advisories@github.com · Third Party Advisory

https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z

Source: af854a3a-2127-422b-91ae-364da2661108 · Release Notes

Frequently Asked SecOps Questions (CVE-2023-28432)

FAQ

Q1. How critical is CVE-2023-28432 and is it actively exploited in the wild?

CVE-2023-28432 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 84.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-28432?

Primary impacted vendors include minio across minio. Scope summary: All MinIO distributed deployments from RELEASE.2019-12-17T23-16-33Z up to (but excluding) RELEASE.2023-03-20T20-16-18Z

Q3. What temporary mitigations or workarounds exist for CVE-2023-28432 before patching?

[Mitigation] Immediately upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, and rotate all potentially exposed root credentials immediately Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION