CVE-2026-40344

CVE-2026-40344 is an authentication bypass vulnerability in MinIO's Snowball auto-extract handler that allows any user with a valid access key to write arbitrary objects to any bucket without cryptographic signature verification. The vulnerability affects MinIO versions from RELEASE.2023-05-18 through RELEASE.2026-04-11, impacting any MinIO deployment that has the Snowball auto-extract feature enabled. The root cause stems from incomplete implementation of the authTypeStreamingUnsignedTrailer authentication type, which was added to other handlers but omitted from PutObjectExtractHandler, causing signature verification to be bypassed entirely. The attack vector is network-based and requires only knowledge of a valid access key and target bucket name, making it relatively low-complexity to execute. An attacker sends a specially crafted PUT request with STREAMING-UNSIGNED-PAYLOAD-TRAILER headers and a fabricated signature, which is accepted due to missing signature validation logic. The potential impact is severe, as successful exploitation enables unauthorized object write access and arbitrary code execution through tar payload extraction, affecting confidentiality, integrity, and availability of stored data. There is no current evidence of active exploitation in the wild, with the vulnerability holding an inactive status on the Known Exploited Vulnerabilities list. However, the Faucet Risk Score of 51.0/100 indicates moderate concern, and the vulnerability's relative simplicity makes it likely that exploitation tools could be rapidly developed. Remediation options include upgrading to the patched release, blocking unsigned-trailer requests at the load balancer level, restricting WRITE permissions to trusted principals, or requiring clients to use the signed variant of streaming payloads.