Vulnerability DatabaseCVE-2025-32963
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-32963
Published:April 22, 2025
Updated:August 06, 2026
MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the "spec.audiences" field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.
Affected Packages
https://github.com/minio/operator.git (GITHUB):
Affected version(s) >=v5.0.0 <v7.1.0
Fix Suggestion:
Update to version v7.1.0
Related Resources (6)
https://github.com/minio/operator/releases/tag/v7.1.0
https://nvd.nist.gov/vuln/detail/CVE-2025-32963
https://github.com/minio/operator/commit/d586294d526bf0d8e6097225114655f68b0adcc5
https://github.com/minio/operator
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32963.json
https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Insufficiently Protected Credentials
CWE-522
EPSS
Base Score:
0.59