Introduction
In MinIO object storage, a service account that is supposed to be tightly restricted can silently gain the full privileges of its parent user. That breaks least privilege and exposes sensitive data to unauthorized access. Organizations that rely on session or inline policies to contain the blast radius of a compromised credential are directly affected, and the risk extends to modifying, deleting, and creating objects without authorization.
MinIO is a high-performance object storage system compatible with the Amazon S3 APIs. It is widely used in enterprise, government, and cloud-native environments, and its flexible IAM model and Kubernetes integration make it a popular choice for scalable private cloud storage.
Technical information
CVE-2025-62506 is a privilege escalation vulnerability in MinIO's Identity and Access Management (IAM) subsystem. The flaw exists in all versions prior to RELEASE.2025-10-15T17-29-55Z. It affects service accounts and Security Token Service (STS) accounts that are restricted by session or inline policies.
The bug is in the policy validation logic that runs when one of these restricted accounts performs an operation on itself, specifically when it creates a new service account for the same user. During session policy validation, the IAM code relies on the DenyOnly argument. Instead of checking whether the session policy explicitly allows an action, it only checks that the policy does not explicitly deny it. So if a session policy is present and does not explicitly deny creating a service account, the action goes through, even when the policy never explicitly allowed it.
An attacker with valid credentials for a restricted service or STS account can therefore create a new service account for themselves. The new account does not carry the original account's policy restrictions. It inherits the full privileges of the parent user instead. The attacker bypasses the intended security controls and can access, modify, delete, or create objects and buckets outside their authorized scope.
The root cause is the DenyOnly logic in session policy validation, which breaks the intended intersection of session and base policies. The fix, implemented in pull request #21642, changes session policy validation so that an action must be explicitly allowed rather than simply not denied.
Affected systems and versions
- Product: MinIO object storage
- Affected versions: All versions prior to RELEASE.2025-10-15T17-29-55Z
- Vulnerable configurations: Any deployment using service accounts or STS accounts with restricted session or inline policies
Vendor security history
MinIO has a documented history of IAM-related vulnerabilities:
- CVE-2024-24747: Privilege escalation via admin:UpdateServiceAccount permission inheritance
- CVE-2024-55949: IAM import API privilege escalation
MinIO typically responds quickly to disclosures with detailed advisories and patches. Still, IAM logic flaws keep recurring, which points to ongoing complexity and risk in its access control implementation.
