CVE-2021-41266: Authentication bypass issue in the Operator Console
Summary
CVE-2021-41266: Authentication bypass issue in the Operator Console. Affects github.com/minio/console versions < 0.12.3. Fixed in 0.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Operator Console is a component of the MinIO project, written in Go. It provides a web-based interface for managing and monitoring MinIO deployments. The console allows users to perform various administrative tasks, such as creating buckets, managing users, and configuring access policies. The vulnerability identified in this advisory affects versions of the console up to v0.12.2. It is an authentication bypass issue that occurs when an external identity provider (IDP) is enabled.
Vulnerability Detail
The authentication bypass issue in the Operator Console allows unauthorized access to the console's functionalities when an external IDP is enabled. This means that an attacker could potentially bypass the authentication mechanism and gain administrative privileges without valid credentials. The impact of this vulnerability is significant, as it allows unauthorized individuals to perform administrative actions on the MinIO deployment, potentially leading to data breaches, unauthorized access, and other malicious activities. The vulnerability has been assigned a CVSS score of 8.6, indicating a high severity level.
How To Fix
Latest published version: v1.7.6 as of 23 Oct 2026
go get github.com/minio/console@v1.7.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
go get github.com/minio/console@v0.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, users can implement a workaround by modifying the operator-console deployment in Kubernetes. By adding the automountServiceAccountToken: false parameter, the service account token will not be mounted inside the pod. Additionally, the external identity provider authentication can be disabled by unsetting the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET, and CONSOLE_IDP_CALLBACK environment variables. Instead, the Kubernetes service account token can be used for authentication.
Conclusion
The authentication bypass vulnerability in the Operator Console poses a significant risk to MinIO deployments. Users are strongly advised to upgrade to the latest release of the console (v0.12.3 or later) to mitigate this vulnerability. Alternatively, the provided workaround can be implemented until the upgrade is performed. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/minio/console →
FAQ
The vulnerability allows unauthorized access to the Operator Console, potentially leading to unauthorized administrative actions and data breaches.
Versions up to v0.12.2 are affected by this vulnerability.
No, this vulnerability has not been observed in the wild or reported elsewhere in the community.
To upgrade, follow the instructions provided by the MinIO project for upgrading the Operator Console to the latest release (v0.12.3 or later).
Yes, users can implement a workaround by modifying the operator-console deployment in Kubernetes and disabling the external identity provider authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/minio/console.
