{"cve":"CVE-2021-41266","nvd":{"published":"2021-11-15T21:15:07.320","modified":"2026-06-17T04:08:12.147","status":"Modified","description":"Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-306"],"references":["https://github.com/minio/console/pull/1217","https://github.com/minio/console/security/advisories/GHSA-4999-659w-mq36","https://github.com/minio/console/pull/1217","https://github.com/minio/console/security/advisories/GHSA-4999-659w-mq36"],"products":["min:minio_console"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-41266","score":0.48134,"percentile":0.9886,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-4999-659w-mq36","url":"https://osv.dev/vulnerability/GHSA-4999-659w-mq36","summary":"Authentication bypass issue in the Operator Console","modified":"2026-05-04T08:46:07.417661963Z","packages":[{"ecosystem":"Go","name":"github.com/minio/console","purl":"pkg:golang/github.com/minio/console","ranges":["<0.12.3"],"fixed":["0.12.3"]}]},{"id":"GO-2022-0261","url":"https://osv.dev/vulnerability/GO-2022-0261","summary":"Authentication bypass issue in the Operator Console in github.com/minio/console","modified":"2026-03-03T04:49:53.879668Z","packages":[{"ecosystem":"Go","name":"github.com/minio/console","purl":"pkg:golang/github.com/minio/console","ranges":["<0.12.3"],"fixed":["0.12.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}