Impact Score: 5/10
MinIO: Security and Bug Fixes Release
Source available — automated, not human-reviewed
Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
MinIO RELEASE.2023-03-20T20-16-18Z. Source highlight: Information Disclosure in Cluster Deployment
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (4)
- Add enable flag for LDAP IDP config
- Added query parameter `src` to diag upload if callhome enabled
- Add support for batch job cancellation
- add crash protection from backend modifications
🔧 Bug Fixes & Patches (5)
- fix: return appropriate Location header for MakeBucket()
- debug: new tool to reorder local erasure disks
- fix: post policy request security bypass
- fix: convert '\' to '/' on windows
- Add test for fixed post policy exploit
📄 View Raw Release Notes (Original Developer Log)
## Highlights
- [Information Disclosure in Cluster Deployment](https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q)
- [Privilege Escalation on Linux/MacOS](https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c)
- [Privilege Escalation on Windows via Path separator manipulation](https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6)
## What's Changed
* Update audit log flow to use new headers with unit by @nitisht in https://github.com/minio/minio/pull/16797
* restore rotating root credentials properly by @harshavardhana in https://github.com/minio/minio/pull/16812
* remove unncessary logs from WalkDir(), PutObject() by @harshavardhana in https://github.com/minio/minio/pull/16818
* update go dependencies by @harshavardhana in https://github.com/minio/minio/pull/16798
* fix: return appropriate Location header for MakeBucket() by @harshavardhana in https://github.com/minio/minio/pull/16820
* debug: new tool to reorder local erasure disks by @vadmeste in https://github.com/minio/minio/pull/16816
* support decommissioning of tiered objects by @poornas in https://github.com/minio/minio/pull/16751
* Add enable flag for LDAP IDP config by @donatello in https://github.com/minio/minio/pull/16805
* simplify error responses for KMS by @harshavardhana in https://github.com/minio/minio/pull/16793
* Added query parameter `src` to diag upload if callhome enabled by @shtripat in https://github.com/minio/minio/pull/16837
* reduce 250ms to 50ms retry looking for metacache block by @harshavardhana in https://github.com/minio/minio/pull/16795
* Save bootstrap trace events in a circular buffer by @krisis in https://github.com/minio/minio/pull/16823
* Add support for batch job cancellation by @poornas in https://github.com/minio/minio/pull/16843
* fix: post policy request security bypass by @donatello in https://github.com/minio/minio/pull/16849
* fix: convert '\' to '/' on windows by @harshavardhana in https://github.com/minio/minio/pull/16852
* Add test for fixed post policy exploit by @donatello in https://github.com/minio/minio/pull/16855
* allow bootstrapping to validate internode tokens by @harshavardhana in https://github.com/minio/minio/pull/16853
* add crash protection from backend modifications by @harshavardhana in https://github.com/minio/minio/pull/16846
* reject object names with '\' on windows by @harshavardhana in https://github.com/minio/minio/pull/16856
* Use the official pub key to always verify binary by @donatello in https://github.com/minio/minio/pull/16857
**Full Changelog**: https://github.com/minio/minio/compare/RELEASE.2023-03-13T19-46-17Z...RELEASE.2023-03-20T20-16-18Z