IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-04-22 18:16

MODIFIED

2025-04-23 14:08

EPSS (Prob. Exploit)

0.63%

Top 49.6%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7m6v-q233-q9j9 MODERATE

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

AFFECTED PACKAGES:

GO / github.com/minio/operator

< 7.1.0

Fixed in: 7.1.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

AFFECTED PACKAGES:

Unknown / Unknown

152 versions affected

ALIASES:

GHSA-7m6v-q233-q9j9, GO-2025-3637

> HISTORIQUE DES MODIFICATIONS

Première apparition

22/04/2025 18:16

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:03

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui