{"affected":[{"defaultStatus":"unaffected","product":"MinIO","source":"CNA: chainguard","vendor":"Chainguard","versions":[{"lessThanOrEqual":"RELEASE.2026-09-21T00-15-41Z","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-122267","cwes":["CWE-347"],"description":"MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: chainguard","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793916011719,"publishedAt":1793916011719,"references":[{"source":"CNA: chainguard","tags":[],"url":"https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg"}],"remediation":[],"revision":"1b86b59f0dcf5ea55ca745316807f1331ccc889fb4fa48c1d87f49ffc7af3794","sources":[{"modifiedAt":1793916011719,"name":"CNA: chainguard","retrievedAt":1793916848974,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122267"}],"ssvc":null,"status":"published","title":"CVE-2026-122267","updatedAt":1793916848974}