# MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

MinIO's unsigned-trailer upload path skips signature verification when Authorization header is absent, letting anyone with a valid access key write objects without the secret key.

- Payout: Research
- Severity: high
- Program: MinIO
- Found by: ddd
- Disclosed: 2026-04-14
- CVE: CVE-2026-41145
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-hv4r-mvr4-25vw
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-hv4r-mvr4-25vw
- Tags: area:cloud domain:cloud impact:integrity kind:research platform:ghsa sev:high tech:s3 technique:default-creds technique:source-review vuln:access-control vuln:auth-bypass

**Target:** S3-compatible object storage PutObject/PutObjectPart handlers
**Root cause:** The signature-verification gate for newUnsignedV4ChunkedReader is keyed only on presence of the Authorization header, while isPutActionAllowed accepts credentials from either the Authorization header or the X-Amz-Credential query parameter, so query-string-only credentials skip doesSignatureMatch entirely.
**Steps:**
1. Identify a target MinIO deployment and a valid access key (e.g. default `minioadmin`) with WRITE on a bucket.
2. Send a PutObject request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, credentials supplied only via the `X-Amz-Credential` query parameter, and no `Authorization` header.
3. The gate `r.Header.Get(xhttp.Authorization) != ""` evaluates false, `doesSignatureMatch` is never called, and the object is written under the impersonated key's permissions.
4. Repeat against `PutObjectPartHandler` for multipart uploads.
**How found:** Code review comparing the two credential-extraction paths: the streaming reader's gate checks only the Authorization header, while isPutActionAllowed also honors X-Amz-Credential in the query string — a mismatch that lets one path see credentials the other never validates.
**Exploitation:** Attacker with any valid access key (including default minioadmin) writes arbitrary objects to any bucket they have WRITE on, without knowing the secret key or producing a valid signature, by omitting the Authorization header and passing credentials via query string with the unsigned-trailer payload header.
**Insight:** When auth logic is split across a permission check and a signature check, verify both read credentials from the same sources; any header-vs-query-string asymmetry in credential extraction is a bypass candidate, especially in SigV4 streaming/chunked paths.