CVE-2025-32963 MEDIUM

CVE-2025-32963: Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

Vendor Minio
Product operator
Weakness CWE-522 · Insufficiently protected credentials
Published April 22, 2025
Last update January 23, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

Key dates

02Disclosure timeline

April 22, 2025 CVE published
January 23, 2026 Record updated