CVE-2021-41266

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412676.5Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP com CVE-2021-412688.8Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP compon CVE-2021-412699.8cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected vers CVE-2021-41279.8An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thu CVE-2021-412706.5Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a CVE-2021-412715.3Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cac CVE-2021-412727.5Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations r CVE-2021-412734.3Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on CVE-2021-412748.8solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_CVE-2021-412758.8spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront frame CVE-2021-412767.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does CVE-2021-412777.5Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`