MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint — CVE-2026-42600

Summary

### Impact _What kind of vulnerability is it? Who is impacted?_ A path traversal vulnerability in MinIO's `ReadMultiple` internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. Distributed-erasure (multi-node) MinIO deployments are impacted. Single-node standalone deployments do not register the route…

Product

go: github.com/minio/minio

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Related advisories