CVE-2021-41137

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411385.3Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a laCVE-2021-411396.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time TrackCVE-2021-411405.3Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactioCVE-2021-411417.5PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIPCVE-2021-411425.4Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scCVE-2021-411437.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could eCVE-2021-411448.8OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execCVE-2021-411457.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2021-411468.8qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebCVE-2021-411477.2Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.9CVE-2021-411488.8Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.9CVE-2021-411498.1Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior