MinIO (server-side encryption / replication): An authenticated tenant can inject SSE metadata through replication

Impact

An authenticated tenant can inject SSE metadata through replication headers, corrupting how objects are recorded as encrypted. The practical outcome is objects that cannot be decrypted afterwards - durable data loss on a replicated bucket, plus confusion about which objects are actually protected.

Who can reach it

Any authenticated MinIO user able to send replication-related headers to the S3 endpoint.

What to do

Upgrade to the fixed release from GHSA-3rh2-v3gr-35p9 and restart the cluster. Verify readability of objects written during the exposure window on SSE-enabled replicated buckets, and restrict replication header handling to your replication service account.

References