Approved changes feed: RSS · Atom

cpe:2.3:a:minio:operator:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorMinio (35f49dd5-5bfa-5710-9cf4-73c05d949fef)
ProductOperator (2afd611e-4283-51e6-b15e-08f03d151254)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-32963 vulnerable 2026-06-08 07:19:01.242216 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.
Published: 2025-04-22T17:14:56.958Z
Updated: 2026-01-23T17:16:16.416Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.