CVE-2025-32963: MinIO Operator Vulnerability in STS Audience Handling
Summary
CVE-2025-32963: Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS. Affects github.com/minio/operator versions < 7.1.0. Fixed in 7.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MinIO Operator is a Kubernetes-native IAM Authentication tool that provides Secure Tokens (STS) for managing access to MinIO Tenants. It allows applications to access MinIO without needing explicit credentials, enhancing security and ease of use. However, the operator's handling of Kubernetes apiserver audiences for STS can lead to potential security risks, particularly around token validation and privilege escalation.
Vulnerability Detail
The vulnerability arises from the MinIO Operator's reliance on the Kubernetes apiserver audience for the AssumeRoleWithWebIdentity STS feature. If the audience is not properly scoped, a ServiceAccount token could be valid for multiple audiences, allowing it to be misused or replayed in unintended contexts. This could lead to privilege escalation or token leakage, as tokens may be accepted by other internal systems that trust the Kubernetes API server without proper validation.
How To Fix
Latest published version: v0.4.0 as of 23 Oct 2026
go get github.com/minio/operator@v0.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.0
This is the first release that contains the fix.
go get github.com/minio/operator@v7.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the automatic mounting of service account tokens by setting 'automountServiceAccountToken: false' in your ServiceAccount definition. Here is an example YAML configuration:
apiVersion: v1 kind: ServiceAccount metadata: namespace: namespace-name name: service-account-name automountServiceAccountToken: false
Additionally, you can request an audience-specific token in your pod configuration:
apiVersion: batch/v1 kind: Job metadata: name: job-name namespace: job-namespace spec: template: spec: serviceAccountName: service-account-name volumes: - name: sa-token projected: sources: - serviceAccountToken: audience: "sts.min.io" expirationSeconds: 86400 path: token containers: - name: mc volumeMounts: - name: sa-token mountPath: /var/run/secrets/sts.min.io/serviceaccount readOnly: true
Conclusion
The MinIO Operator vulnerability CVE-2025-32963 highlights the importance of proper audience handling in Kubernetes STS implementations. By updating to the patched version and following best practices for token management, users can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for github.com/minio/operator →
FAQ
CVE-2025-32963 is a vulnerability in the MinIO Operator related to the handling of Kubernetes apiserver audiences for STS, which can lead to token misuse and privilege escalation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential privilege escalation and token leakage, as tokens may be accepted by unintended services if not properly scoped.
You can update the MinIO Operator to version 7.1.0 or later by running the command 'go get github.com/minio/operator@v7.1.0'.
Audience-specific tokens ensure that ServiceAccount tokens are only valid for their intended audience, reducing the risk of misuse in other contexts.
