ACTIVELY EXPLOITED
CVE-2023-28432: MinIO Information Disclosure Vulnerability
| Vendor | MinIO |
|---|---|
| Product | MinIO |
| Actively exploited | Yes |
| Added to CISA KEV | 21 Apr 2023 |
| CISA federal deadline | 12 May 2023 |
| Weakness (CWE) | CWE-200 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.
SOURCES
Other MinIO flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.