IAM
6 pages-
SN-2026-015: PutObjectRetention Authorization Bypass
Status on 2026-09-26: design, not fixed. This is a fix design for review. No SILO release fixes this defect yet. Every published Server release is affected, including RELEASE.2026-09-16T00-00-00Z, and so is Server main at b0a540190. The code came …
Status on 2026-09-26: design, not fixed. This is a fix design for review. No SILO release fixes this defect yet. Every published Server release is affected, including RELEASE.2026-09-16T00-00-00Z, and so is Server main at b0a540190. The code came …
-
September Security Repairs: Payload Integrity, IAM Revocation and Console Sharing
Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …
Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …
-
SILO 20260903 Security Notes: SN-2026-006 through 010
Released in SILO 20260903. These fixes are part of RELEASE.2026-09-03T13-18-01Z. See the complete release notes for the 20260806-to-20260903 upgrade boundary, components, verification evidence, and known deferrals. This bulletin collects five …
Released in SILO 20260903. These fixes are part of RELEASE.2026-09-03T13-18-01Z. See the complete release notes for the 20260806-to-20260903 upgrade boundary, components, verification evidence, and known deferrals. This bulletin collects five …
-
Explicit Version Deletes Now Require DeleteObjectVersion
Release status: this change is implemented in pgsty/silo#104, tracking issue #58. Publishing this note does not by itself mean that a server release, package, image, or deployment contains the change. SILO now maps object-delete authorization to the …
Release status: this change is implemented in pgsty/silo#104, tracking issue #58. Publishing this note does not by itself mean that a server release, package, image, or deployment contains the change. SILO now maps object-delete authorization to the …
-
One Endpoint, Two Privileges: Separating User and Group Status
Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …
Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …
-
CVE-2025-62506: Session-Policy Privilege Escalation
Status: Inherited and released First Silo community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account with …
Status: Inherited and released First Silo community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account with …