6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32963

CVE-2025-32963: Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the spec.audiences field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32963

CVE-2025-32963:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/minio/operator	go	< 7.1.0	7.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability arises from the MinIO Operator not correctly specifying and verifying the 'audience' for Kubernetes Service Account tokens used in its STS AssumeRoleWithWebIdentity flow.

The ValidateServiceAccountJWT function in pkg/controller/sts.go was responsible for preparing the TokenReview request. Prior to the patch (d586294), it did not set the spec.audiences field. This caused the Kubernetes API server to default the audience, typically to its own, which is not specific enough for the MinIO STS use case.
The AssumeRoleWithWebIdentityHandler function in pkg/controller/sts_handlers.go, which processes the AssumeRoleWithWebIdentity request and uses the result of ValidateServiceAccountJWT, did not check the status.audiences field in the TokenReview response to ensure the token was intended for sts.min.io.

The patch d586294 addresses both issues: ValidateServiceAccountJWT was modified to include sts.min.io in spec.audiences of the TokenReview request, and AssumeRoleWithWebIdentityHandler was modified to explicitly check for sts.min.io in the status.audiences of the TokenReview response. Both functions were integral to the vulnerable process: one for not requesting the correct audience scope, and the other for not verifying the audience of the validated token.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.