Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-32963

Good to know:

icon

Date: April 22, 2025

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the "spec.audiences" field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

Severity Score

Related Resources (5)

https://github.com/minio/operator/releases/tag/v7.1.0
https://nvd.nist.gov/vuln/detail/CVE-2025-32963
https://github.com/minio/operator
https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9
https://www.mend.io/vulnerability-database/CVE-2025-32963

Severity Score

Weakness Type (CWE)

Insufficiently Protected Credentials

CWE-522

Top Fix

icon

Upgrade Version

Upgrade to version github.com/minio/operator - v7.1.0;https://github.com/minio/operator.git - v7.1.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us