CVE-2025-32963: MinIO Operator STS Auth Bypass Vulnerability

CVE-2025-32963 Overview

CVE-2025-32963 affects the MinIO Operator Security Token Service (STS), a native Identity and Access Management (IAM) authentication component for Kubernetes. Versions prior to 7.1.0 fail to enforce a scoped audience on service account tokens submitted for authentication. When the spec.audiences field is unset, the default audience becomes the Kubernetes apiserver, allowing tokens intended for other services to be replayed against the MinIO STS endpoint. The flaw maps to [CWE-522: Insufficiently Protected Credentials]. The MinIO project patched the issue in version 7.1.0 by requiring the explicit sts.min.io audience during TokenReview.

Critical Impact
Service account tokens issued for the default Kubernetes apiserver audience can be replayed against MinIO Operator STS, potentially granting unauthorized access to object storage IAM credentials.

Affected Products

MinIO Operator versions prior to 7.1.0
Kubernetes clusters deploying MinIO Operator STS without explicit spec.audiences
Workloads using service account tokens minted with the default apiserver audience

Discovery Timeline

2025-04-22 - CVE-2025-32963 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32963

Vulnerability Analysis

The MinIO Operator STS service authenticates callers by submitting their bearer token to the Kubernetes TokenReview API. Prior to the patch, the operator did not specify an Audiences field on the TokenReview request. Kubernetes then validated the token against the default apiserver audience.

Any valid service account token bound to the apiserver audience — which is essentially every default projected token in the cluster — was accepted as a legitimate STS caller. This broke the audience-scoping guarantee that OIDC-style bearer tokens are designed to provide. An attacker able to obtain a service account token from an unrelated workload could replay it against the STS endpoint to request MinIO IAM credentials.

Root Cause

The root cause is a missing audience check in the STS handler. The TokenReview request omitted the target audience, and the response was accepted regardless of the audiences the token was actually scoped for. This is a classic [CWE-522] pattern where a credential is trusted beyond its intended trust boundary.

Attack Vector

An attacker with access to any pod holding a default projected service account token — for example through a compromised sidecar, a container escape, or a Server-Side Request Forgery (SSRF) chain that can read /var/run/secrets/kubernetes.io/serviceaccount/token — can send that token to the MinIO Operator STS endpoint. The operator authenticates the token against the apiserver audience and issues MinIO credentials tied to the associated service account.

// Patch: pkg/controller/sts.go — introduces a dedicated audience constant
const (
    // TokenReviewAudience is the audience for the token review request
    TokenReviewAudience = "sts.min.io"
)
// Source: https://github.com/minio/operator/commit/d586294d526bf0d8e6097225114655f68b0adcc5

// Patch: pkg/controller/sts_handlers.go — enforce audience on TokenReview result
isSSTSAudience := false
for _, audience := range saAuthResult.Status.Audiences {
    if audience == TokenReviewAudience {
        isSSTSAudience = true
    }
}

if !isSSTSAudience {
    writeSTSErrorResponse(w, true, ErrSTSAccessDenied,
        fmt.Errorf("Access denied: Invalid Token, audience '%s' not found", TokenReviewAudience))
    return
}
// Source: https://github.com/minio/operator/commit/d586294d526bf0d8e6097225114655f68b0adcc5

The patch requires the returned token audiences to contain sts.min.io. Tokens scoped only to the default apiserver audience are now rejected.

Detection Methods for CVE-2025-32963

Indicators of Compromise

Unexpected AssumeRoleWithWebIdentity or STS calls to the MinIO Operator service originating from pods that do not normally interact with object storage.
TokenReview audit events in the Kubernetes API server referencing MinIO STS but originating from service accounts unrelated to MinIO workloads.
MinIO access logs showing IAM credentials being issued to service accounts outside the expected tenant namespaces.

Detection Strategies

Enable Kubernetes API server audit logging for TokenReview and serviceaccounts/token subresources and alert on cross-namespace token usage against the MinIO STS endpoint.
Correlate MinIO Operator STS access logs with the requesting pod identity and flag tokens whose audience set does not include sts.min.io.
Deploy a network policy or service mesh telemetry rule that logs any pod initiating traffic to the MinIO Operator STS service on port 4223.

Monitoring Recommendations

Monitor the MinIO Operator version currently deployed in each cluster and alert on any instance older than 7.1.0.
Track issuance rates of MinIO IAM credentials per service account and investigate sudden spikes from previously inactive identities.
Review Kubernetes projected volume ServiceAccountToken configurations to identify workloads still relying on the default apiserver audience.

How to Mitigate CVE-2025-32963

Immediate Actions Required

Upgrade MinIO Operator to version 7.1.0 or later in every cluster.
Set spec.audiences on all PolicyBinding and tenant resources to include sts.min.io for projected service account tokens.
Rotate any MinIO IAM credentials issued by the STS service during the vulnerable window.
Audit RBAC bindings for service accounts that can reach the MinIO Operator STS endpoint and remove unnecessary access.

Patch Information

The fix is available in MinIO Operator v7.1.0 via commit d586294. See the GitHub Security Advisory GHSA-7m6v-q233-q9j9 for complete vendor guidance.

Workarounds

Configure workloads to request projected service account tokens with an explicit sts.min.io audience rather than relying on the apiserver default.
Restrict network reachability to the MinIO Operator STS service using NetworkPolicy so only trusted tenant namespaces can invoke it.
Apply Kubernetes admission policies that deny use of unaudienced service account tokens for STS authentication until the upgrade is complete.

bash

# Example: request a scoped projected service account token for MinIO STS
kubectl create token my-app-sa \
  --audience=sts.min.io \
  --duration=1h

# Example PodSpec fragment enforcing the scoped audience
#   volumes:
#   - name: minio-sts-token
#     projected:
#       sources:
#       - serviceAccountToken:
#           path: token
#           audience: sts.min.io
#           expirationSeconds: 3600