Security/CVE RELEASE.2025-10-15T17-29-55Z

Security

A CVE was reported Privilege Escalation via Session Policy Bypass in Service Accounts and STS and fixed in this release,

All users are advised to download and upgrade their MinIO setup immediately.

To install the latest release

go install -v github.com/minio/minio@latest

OR

go install -v github.com/minio/minio@RELEASE.2025-10-15T17-29-55Z

For container environments, please clone the source and build the latest container.

git clone https://github.com/minio/minio
git checkout RELEASE.2025-10-15T17-29-55Z
TAG=myregistry.com/minio/minio:RELEASE.2025-10-15T17-29-55Z make docker

What's Changed

• fix: remove unnecessary replication checks by @0xMALVEE in minio#21569
• LDAP TLS handshake fails with StartTLS and tls_skip_verify=off by @mosesdd in minio#21582
• fix: incorrect poolID when after decommission adding pools by @jiuker in minio#21590
• fix: after saveRebalanceStats cancel will be empty by @jiuker in minio#21597
• Use new gofumpt by @klauspost in minio#21613
• fix: timeN function return final closure not be called by @drivebyer in minio#21615
• Updating readme for MinIO docs by @ravindk89 in minio#21625
• Update README with Docker and Helm installation instructions by @ravindk89 in minio#21627
• Bump Go version in toolchain directive to 1.24.8 by @marktheunissen in minio#21629
• fix: allow trailing slash in AWS S3 POST policies by @cduzer in minio#21612
• Change documentation link in README by @ravindk89 in minio#21636
• fix: check sub-policy properly when present by @donatello in minio#21642

New Contributors

• @mosesdd made their first contribution in minio#21582
• @cduzer made their first contribution in minio#21612

Full Changelog: minio/minio@RELEASE.2025-09-07T16-13-09Z...RELEASE.2025-10-15T17-29-55Z

RELEASE.2025-09-07T16-13-09Z

What's Changed

• Update console to v2.0.3 by @bexsoft in minio#21474
• bring more idempotent behavior to AbortMultipartUpload() by @jiuker in minio#21475
• fix: record extral skippedEntry for listObject by @jiuker in minio#21484
• feat: add variable for datasource in grafana dashboards by @hornjo in minio#21470
• imagePullSecrets consistent types for global , local by @0xMALVEE in minio#21500
• Optimize outdated commands in the log by @dormanze in minio#21498
• fix(helm): do not suspend versioning by default for buckets, only set versioning if specified(21349) by @LOCODAK in minio#21494
• Check legalHoldPerm by @klauspost in minio#21508
• fix: errUploadIDNotFound will be ignored when err is from peer client by @jiuker in minio#21504
• fix: claim based oidc for official aws libraries by @0xMALVEE in minio#21468
• fix: add name and description to ldap accesskey list by @jiuker in minio#21511
• Modify permission verification type by @dormanze in minio#21505
• fix: when claim-based OIDC is configured, treat unknown roleArn as claim-based auth by @ianroberts in minio#21512
• custom user-agent transport wrapper by @0xMALVEE in minio#21483
• Update docs links throughout by @djwfyi in minio#21513
• http/listener: fix bugs and simplify by @denpeshkov in minio#21514
• fix: use amqp.ParseURL to parse amqp url by @jiuker in minio#21528
• fix: invalid checksum on site replication with conforming checksum types by @marktheunissen in minio#21535
• Revert dns.msgUnPath, fixes minio#21541 by @mannreis in minio#21542
• Run modernize by @klauspost in minio#21546
• fix: when save the rebalanceStats not found the config file by @jiuker in minio#21547
• Updated object-browser to the latest version v2.0.4 by @bexsoft in minio#21564
• fix: return error on conditional write for non existing object by @0xMALVEE in minio#21550
• Fix support for legacy compression env variables by @WGH- in minio#21533
• fix: use correct dummy ARN for claim-based OIDC provider when listing access keys by @ianroberts in minio#21549
• fix: conditional checks write for multipart by @0xMALVEE in minio#21567

New Contributors

• @LOCODAK made their first contribution in minio#21494
• @ianroberts made their first contribution in minio#21512
• @denpeshkov made their first contribution in minio#21514

Full Changelog: minio/minio@RELEASE.2025-07-23T15-54-02Z...RELEASE.2025-09-07T16-13-09Z

RELEASE.2025-07-23T15-54-02Z

What's Changed

• Add support for X25519MLKEM768 by @loganaden in minio#21435
• fix: restrict SinglePool by the minimum free drive threshold by @jiuker in minio#21115
• wait for metadata reads on minDisks+1 for HEAD/GET when data==parity by @harshavardhana in minio#21449
• fix boundary value bug when objTime ends in whole seconds (without sub-second) by @supermp in minio#21419
• simplify validating policy mapping by @0xMALVEE in minio#21450

New Contributors

• @loganaden made their first contribution in minio#21435
• @supermp made their first contribution in minio#21419
• @0xMALVEE made their first contribution in minio#21450

Full Changelog: minio/minio@RELEASE.2025-07-18T21-56-31Z...RELEASE.2025-07-23T15-54-02Z

Bugfix Release

What's Changed

• do not list buckets without local quorum by @harshavardhana in minio#20852
• Add Full Object Checksums and CRC64-NVME by @klauspost in minio#20855

Full Changelog: minio/minio@RELEASE.2025-01-18T00-31-37Z...RELEASE.2025-01-20T14-49-07Z