CVE-2025-27414: MinIO SFTP Authentication Bypass Flaw

CVE-2025-27414 Overview

CVE-2025-27414 is an authentication bypass vulnerability [CWE-287] in MinIO, a high-performance object storage system. The flaw affects MinIO releases from RELEASE.2024-06-06T09-36-42Z up to but not including RELEASE.2025-02-28T09-55-16Z. The bug lies in how MinIO evaluates trust of Secure Shell (SSH) keys used in Secure File Transfer Protocol (SFTP) connections when Lightweight Directory Access Protocol (LDAP) is configured as the external identity provider. When a target LDAP user has no sshPublicKey attribute set, MinIO incorrectly trusts any key presented by the client. Attackers can then perform any FTP operation permitted by the access policies bound to that LDAP user or their groups.

Critical Impact
Attackers with knowledge of a valid LDAP username lacking an sshPublicKey attribute can bypass SFTP authentication and read, write, delete, or list objects allowed by the associated MinIO access policies.

Affected Products

MinIO RELEASE.2024-06-06T09-36-42Z and later
MinIO releases prior to RELEASE.2025-02-28T09-55-16Z
MinIO deployments with SFTP access enabled and LDAP as the identity provider

Discovery Timeline

2025-02-28 - CVE-2025-27414 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27414

Vulnerability Analysis

MinIO supports SSH key-based authentication for SFTP connections when the LDAP-backed user has an sshPublicKey attribute defined. The server is designed to trust a client's SSH key only when it matches the value stored in that attribute. The bug arises when the LDAP user has no sshPublicKey property set. In that condition, the comparison logic falls through and MinIO trusts the client-supplied key without a valid reference to compare against.

Successful exploitation grants the attacker the same FTP capabilities granted to the impersonated LDAP user, including reading, writing, deleting, and listing objects. The scope of impact directly reflects the MinIO access policies attached to the target LDAP account or any of its groups.

Root Cause

The root cause is improper authentication logic [CWE-287] in the SFTP server component. The public key comparison path did not enforce a default-deny behavior when the reference key was absent. Instead of rejecting authentication when no sshPublicKey exists in LDAP, the code treated the empty state as a successful trust decision.

Attack Vector

Three preconditions must align for exploitation. First, the MinIO server must be configured for SFTP access with LDAP as the external identity provider. Second, the attacker must know an LDAP username that lacks the sshPublicKey attribute. Third, that user or one of their groups must have MinIO access policies configured. The attack is network-based, requires no prior authentication credentials, and does not require user interaction beyond initiating the SFTP session.

// Security patch in cmd/sftp-server.go
// if the sftp parameter --trusted-user-ca-key is set, then
// the final form of the key file will be set as this variable.
-var caPublicKey ssh.PublicKey
+var globalSFTPTrustedCAPubkey ssh.PublicKey

// https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.22.0:ssh/common.go;l=46
// preferredKexAlgos specifies the default preference for key-exchange

Source: GitHub MinIO Commit Update

A companion patch adds proper LDAP public key authentication handling to the SFTP driver. See the GitHub MinIO Commit Fix for the full change to cmd/sftp-server-driver.go.

Detection Methods for CVE-2025-27414

Indicators of Compromise

Successful SFTP authentication events for LDAP users that have no sshPublicKey attribute set in the directory.
Unexpected object read, write, list, or delete operations attributed to LDAP service accounts over the SFTP interface.
SFTP session establishment from source IP addresses outside the expected administrative ranges.

Detection Strategies

Correlate MinIO SFTP authentication logs with LDAP directory contents to identify sessions where the account lacks a corresponding sshPublicKey.
Baseline normal SFTP usage per LDAP identity and alert on new key fingerprints or previously unseen client hosts.
Review MinIO audit logs for FTP operations performed by service or machine accounts that should not use SFTP.

Monitoring Recommendations

Enable MinIO audit logging and forward events to a centralized analytics platform for retention and query.
Monitor LDAP for accounts that hold MinIO access policies but no sshPublicKey attribute; these are the highest-risk targets.
Track version strings reported by MinIO instances to identify hosts still running vulnerable releases between RELEASE.2024-06-06T09-36-42Z and RELEASE.2025-02-28T09-55-16Z.

How to Mitigate CVE-2025-27414

Immediate Actions Required

Upgrade MinIO to RELEASE.2025-02-28T09-55-16Z or later on every host running the SFTP service.
Inventory LDAP accounts that map to MinIO access policies and confirm each has an sshPublicKey attribute or is denied SFTP access.
Rotate credentials and review recent SFTP audit logs for any activity that predates the patch on vulnerable hosts.

Patch Information

The issue is resolved in MinIO RELEASE.2025-02-28T09-55-16Z. The upstream fix is tracked in the GitHub Security Advisory GHSA-wc79-7x8x-2p58 and delivered through the commits referenced above in cmd/sftp-server.go and cmd/sftp-server-driver.go.

Workarounds

Disable the MinIO SFTP listener until the patched release can be deployed.
Ensure every LDAP account with MinIO access policies has a valid sshPublicKey attribute so the trust comparison has a reference value.
Restrict network access to the SFTP port using firewall rules or a bastion host to reduce exposure while patching is scheduled.

bash

# Verify the running MinIO version and disable SFTP if patching is pending
mc admin info ALIAS

# Start MinIO server without the SFTP argument to disable the listener
# (remove any --sftp "address=..." flags from the service unit)
systemctl edit minio.service
systemctl restart minio.service