CVE-2023-28432

HIGH 7.5

⚠️ CISA KEV

Minio Information Disclosure in Cluster Deployment

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CWE	CWE-200
Vendor	minio
Product	minio
Published	Mar 22, 2023
Last Updated	Oct 21, 2025

⚠️ Actively Exploited — Act Now

Get instant alerts for minio minio

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2023-28432.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

minio / minio

>= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q github.com: https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z twitter.com: https://twitter.com/Andrew___Morris/status/1639325397241278464 viz.greynoise.io: https://viz.greynoise.io/tag/minio-information-disclosure-attempt greynoise.io: https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432