PGSTY SILO Blog on SILO

SILO Console 2.4.1 Released

Wed, 16 Sep 2026 16:36:03 +0800

SILO Console v2.4.1 was released on September 16, 2026 from 1360e26d976d. It integrates pkg v3.14.1 and mcli 20260916, restricts the anonymous sharing proxy, streams multi-object ZIP downloads and adds signed, traceable release artifacts.

The fix for #52 restricts the anonymous proxy to object-content GET requests at the configured S3 origin. It rejects redirects, system paths and query-selected operations that are not object downloads. Public objects, presigned links and version-specific downloads continue to work. No new sharing-disable environment variable is needed.

mcli 20260916 Released

Wed, 16 Sep 2026 00:00:00 +0800

Release: RELEASE.2026-09-16T00-00-00Z · Package: 20260916000000.0.0 · Source: e952aa78f10a.

Changes since 20260913

Adopt silo-pkg v3.14.1, upstream minio-go v7.3.1-0.20260915093545-32e1f32cb176, and JWX v3.3.0. CopyObject retries and propagates S3 errors embedded in HTTP 200 responses, so a failed copy cannot authorize mv to delete its source. JWX correctly escapes JSON field names.
Report mirror permission failures, including unreadable sources, rejected writes and failed local destination removals. Later objects continue; a finite mirror with failures exits 1. These per-object permission errors do not require --skip-errors and do not restart an entire watch scan.
Preserve the existing cancellation/retry path for listing and watcher failures. Persistent listing permission denial can still cause repeated scans; this release does not redesign that retry policy.
Suppress normal final success statistics after a failed mirror. Explicit --summary retains statistics: JSON uses status: failure; text error diagnostics remain on stderr. Transfers completed within one clock tick no longer produce infinite JSON speeds.
Return failure for legalhold set/clear errors, partial recursive retention failures, and moves whose source deletion fails. mv waits for deletion results; successful copies are not rolled back. Retention reports each failed object once instead of duplicate or misleading diagnostics.
Reject empty retention durations and invalid find --regex expressions with normal CLI errors instead of panics.

Automation and upgrade notes

Affected failure paths that returned 0 now return 1. Check final exit status and error records. Per-object success start messages and progress byte counters are not proof that a transfer completed. For mv, a deletion failure may leave both the source and the successfully copied destination; inspect both before retrying.

mcli 20260913 Released

Sun, 13 Sep 2026 09:47:11 +0800

Release: RELEASE.2026-09-13T00-00-00Z · Package: 20260913000000.0.0 · Source: 4f609a4d.

Changes since 20260903

Preserve historical destination versions under mirror --remove --watch.
Keep service-restart dry runs from executing a restart and make noninteractive behavior explicit.
Return failure for transfer and S3 Select errors, honor explicit checksums on empty uploads, and retain pipe JSON output when quiet mode is enabled.
Accept on/off boolean environment values and repair CLI/JSON behavior across supported platforms.
Adopt pkg v3.14.0 and upstream SDK v7.3.1-0.20260910142817-60bd07042d49, refresh Go x/* and UBI dependencies, and keep Go 1.27.1. NetBSD retains the go-systemd v22.6.0 portability pin.

The package retains the policy Deny/NotResource and bounded wildcard repairs from pkg v3.13.3. Correctly preserved denies may now reject requests that relied on lost clauses. Recover already-lost clauses from the original policy source.

silo-pkg 3.14.0 Released

Sun, 13 Sep 2026 08:55:28 +0800

v3.14.0 was published on 2026-09-13 from 827f8109. It is consumed directly as github.com/pgsty/silo-pkg/v3.

Password-policy migration

This release changes authorization semantics. The public Policy.IsAllowedActions method now reports admin:ChangeMyPassword unless explicitly denied; admin:CreateUser requires an explicit Allow. With matching Server/Console source, a CreateUser deny alone no longer locks the caller’s password, while a ChangeMyPassword deny does.

The built-in readonly drops its CreateUser deny. A separate CreateUser Allow can therefore become effective; the added consolereadonly follows the same split and includes bucket listing. Neither policy grants user administration by itself. Saved policies and overrides are not rewritten.

SN-2026-011: Fix and Release Status

Sun, 13 Sep 2026 00:00:00 +0000

Status on 2026-09-13: SN-2026-011 is fixed on Server main, starting with 123325430. The latest published Server, RELEASE.2026-09-03T13-18-01Z, and earlier public Server releases are affected. No new fixed Server release is established by the pkg v3.14.0 or mcli 20260913 publication.

A holder of a signed PUT request could add an unsigned x-amz-copy-source header and turn the permitted write into a copy of another object readable by the signing key. A destination that permits anonymous reads can expose those copied bytes. This affects both presigned and Authorization-header requests; the holder does not need the signing credentials.

SILO Console 2.4.0 Released

Tue, 08 Sep 2026 22:51:37 +0800

v2.4.0 was published on 2026-09-08 from c103d08e. September 16 follow-up: Console v2.4.1 is the current release. This article records the v2.4.0 behavior and dependencies.

Released behavior

Object-browser directories load 100 entries per page by default, with choices of 50, 100, 250, 500 and 1000. Each page uses one S3 continuation-token request. Sorting, filtering and selection apply to the displayed page, not a complete directory scan; there is no unbounded “all” mode.
Version deletion stays bound to the selected object and directory deletion to its prefix. Lifecycle edits preserve independent actions and unexposed settings; replication rule deletion is saved consistently.
Transient network failures preserve sessions. Empty versioning state, malformed sidebar preferences and stale dropdown selections are handled.
Embedded Console restores loopback proxy behavior when Server explicitly enables the policy; standalone trust defaults remain unchanged.
Dependencies include pkg v3.13.3, MC source v0.0.0-20260908140805-c8aa5d25a63a, and upstream SDK 0e78d3f18efe. This release consumed MC as source and did not itself publish a new mcli tag.

Correctly preserved Deny/NotResource clauses may reject requests that relied on old deduplication defects. Restore already-lost clauses from the original policy source. Embedders must copy the MC replacement from the tagged README.

Silo Console 2.2.0 Release Notes

Wed, 26 Aug 2026 00:00:00 +0000

Note

Released on 2026-08-26. v2.2.0 points to final commit 7dc4258a6. The exact tagged tree passed the full CI matrix, vulnerability checks, and release pipeline. The public release contains six standalone binaries, nine Linux packages, and a SHA-256 checksum manifest.

Version: v2.2.0 · Release commit: 7dc4258a6 · Status: released · Repository: pgsty/silo-console

SILO Console 2.2.0 is a correctness-and-hardening release. It adds one new feature — a strictly bounded text preview for logs and structured text — and spends the rest of its budget making existing surfaces tell the truth: downloads that cannot silently ship a truncated archive, progress bars that cannot fabricate a percentage, permission gates that actually disable what they claim to disable, a user API that no longer entangles status changes with group membership, and database notification forms that emit exactly the connection string the server will store.

Silo Console 2.1.0 Released

Thu, 06 Aug 2026 00:00:00 +0000

Published: 2026-08-06 · Version: v2.1.0 · Repository: pgsty/silo-console

SILO Console 2.1.0 is the first feature release after the independent 2.0.0. It does three things:

Speaks two languages — every console screen, help topic, and documentation link now renders in English or Chinese, behind a toggle on every page, with zero new runtime dependencies;
Reads the right metrics — the dashboard moves off the MinIO Metrics V2 names onto V3, with explicit handling for the semantics V3 changed underneath it;
Stops lying in edge cases — a select-all that matched what a bulk action would delete, placeholders that survive object names containing $&, timestamps that carry a timezone, and empty metrics that read “no data” instead of a fabricated 0.

This is a minor release. No environment variable, module path, API contract, binary name, or data layout changes. Upgrading is a binary or image swap.

Silo Console 2.0.0 Released

Tue, 04 Aug 2026 00:00:00 +0000

Published: 2026-08-04 · Version: v2.0.0 · Repository: pgsty/silo-console

SILO Console 2.0.0 is the first major release of this object-storage administration console as an independent project. Continuing from the georgmangold/console v1.9.1 maintenance line, it accomplishes three things:

An independent identity — product name, visual system, documentation entry points, source attribution, and the release pipeline all move into the SILO project, while the Go module path, environment variables, and other compatibility contracts are deliberately retained;
A redesigned interface — the login page, theme system, dashboard, and console details are reworked under one design language, backed by a regenerated brand icon set;
Hardened engineering — the embedded frontend payload shrinks from roughly 10MB to 3.5MB, known dependency vulnerabilities drop to zero, and a batch of inherited defects — including a real runtime data race — is fixed.

Before publication this release went through two independent review passes: a full code review with commit-history restructuring, followed by an adversarial re-verification (exhaustive asset validation, HTTP semantics probing, full routing regression, and smoke tests against the published artifacts themselves).

silo-pkg 3.13.0 Released

Sun, 30 Aug 2026 00:00:00 +0000

Follow-up, 2026-09-13: this article preserves the v3.13.0 release-time migration record. All four maintained components have since adopted the own-module path; current pkg is v3.14.0. The “not yet migrated” statements below describe that earlier date; see the current component matrix.

Release date: 2026-08-30 · Version: v3.13.0 · Commit: 215f116 · Repository: pgsty/silo-pkg

Version 3.13.0 is a breaking release with one theme: the module stops claiming upstream’s import path and takes its own. It also retires the pgsty/silo-go fork, which no longer carried anything upstream lacks.

silo-pkg 3.12.0 Released

Mon, 24 Aug 2026 00:00:00 +0000

Release date: 2026-08-24 · Version: v3.12.0 · Commit: 2b087a1 · Repository: pgsty/silo-pkg

Version 3.12.0 is a main-line minor release with two themes: a policy-write guard for ARN prefixes that name no resource, and the maintained Go 1.27 / etcd 3.7 dependency baseline. It adds two exported inspection/validation methods, raises the verified consumer floor to Go 1.26, and is the first silo-pkg release whose strict validation path is enabled by the SILO server for named-policy and service-account policy writes.

Silo Pkg 3.11.0 Released

Tue, 04 Aug 2026 00:00:00 +0000

Release date: 2026-08-04 · Version: v3.11.0 · Commit: d8b1fa7 · Repository: pgsty/silo-pkg

This is the fork’s first pinned release. It restores the IAM bucket/object resource boundary reported as upstream minio/minio#20449: a policy condition-key bypass fix, three LDAP connection defects, a certificate watcher leak, a seeded-RNG defect, and the module’s real minimum Go version.

Warning

Two things to check before upgrading

This release tightens authorization. Twelve bucket-level write actions are no longer reachable through an object-only resource pattern such as arn:aws:s3:::bucket/*. If you write your own bucket-scoped policies, read The IAM bucket/object boundary — the fix is one line of policy for anyone affected, and MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on restores the previous behaviour in full.
The condition-key fix still needs its server half. The policy lookup change and the server changes that reserve internal condition-key names each cover one half of that problem. The companion server work exists in pgsty/minio commit 2f55347f7 but is not yet on public origin/master, and no published Silo server release contains it. Verify that a later server release explicitly includes it.

What This Repository Is

silo-pkg is a maintained fork of minio/pkg, carrying fixes needed by community MinIO forks that the now commercially driven upstream no longer accepts. The repository was renamed from pgsty/minio-pkg on 2026-08-02.

CVE-2025-62506: Session-Policy Privilege Escalation

Wed, 15 Oct 2025 00:00:00 +0000

Status: Inherited and released
First Silo community release: RELEASE.2025-12-03T12-00-00Z
Upstream fixed release: RELEASE.2025-10-15T17-29-55Z
GitHub advisory: GHSA-jjjj-jwhf-8rgr
Upstream fix: minio/minio#21642

A service account or STS account with a restricted session policy could use an “own account” operation to create another service account without the restriction. The child account then inherited broader parent permissions, turning valid low-privilege credentials into a privilege-escalation path.

Silo did not need a separate backport. The upstream fix and its two regression groups were already in the history from which the community fork was released. This note records that inheritance without duplicating the tests or reconstructing the investigation already captured by the upstream advisory and PR.

Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

Sat, 12 Sep 2026 00:00:00 +0000

The research and design record for SILO #77: why source times, deletion records, and the whole-bucket lock are all needed; how six configuration types handle duplicates and reordering; why rollout needs a default-off switch; and what the tests can and cannot establish.

An Unsigned Header Is Not Part of the Request

Wed, 09 Sep 2026 00:00:00 +0000

A presigned or signed PUT authorized for one object could be turned into a server-side copy of any object the signing key can read, because SigV4 verification only walked the list of signed header names and never the x-amz-* headers that actually arrived, while the router selects CopyObject from an unsigned x-amz-copy-source header. This record defines SILO’s unsigned-header rejection boundary, the payload-hash exception and trusted signature-age derivation, the PutObjectTagging injection reorder, the scope across signature modes, and the release evidence.

Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

Wed, 09 Sep 2026 00:00:00 +0000

The decision record for SILO #153, #152, and #137: distinguish external reports from local evidence, classify delete-marker purges correctly, expose drops from the bounded MRF queue, and give resync cancellation a complete lifecycle. Includes review, rejected alternatives, final validation, and a 2026-09-16 second round covering worker-side purge classification and persisted MRF marker recovery (PR #196).

Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for the replicated-tag repairs merged as PR #193 and #196: SSE-KMS destination copies silently dropped tag revision timestamps, and an empty tag value had no representable revision, so a delayed replication event could resurrect deleted tags. Covers the tombstone semantics, the stored-wins tie change, the two-ended upgrade requirement, and the cost of extra metadata copies during resync.

SILO 20260903 Security Notes: SN-2026-006 through 010

Thu, 03 Sep 2026 00:00:00 +0000

Released in SILO 20260903. These fixes are part of RELEASE.2026-09-03T13-18-01Z. See the complete release notes for the 20260806-to-20260903 upgrade boundary, components, verification evidence, and known deferrals.

This bulletin collects five related security findings from the final SILO Server review. They cover customer-provided encryption keys, client-controlled replication headers, administrative status changes, and explicit object-version deletion.

The identifiers SN-2026-006 through SN-2026-010 are fork-local security-note IDs. They are not CVEs, are not registered in a vulnerability database, and should not be represented as such. The individual CVE chronicle remains one article per CVE; this release bulletin groups findings without CVEs so operators can evaluate one upgrade boundary.

SILO Server 20260903 Pre-release Review

Thu, 03 Sep 2026 00:00:00 +0000

The final adversarial review of every server change after 20260806: confirmed defects, fixes, rejected simplifications, necessary complexity, validation evidence, explicit deferrals, and the distinction between code-level GO and production release. Updated 2026-09-16 with the #116 restart-and-readback verification method.

Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for PR #194 (fix 4fcdf37ce): trusted replication COPY re-extracted raw request metadata through the permissive path, so transport-only aws-chunked encodings and GHSA-redacted user metadata came back into stored objects. Covers the expected encoding mappings, the Snowball behavior change, why upgrading does not repair existing objects, and the status of the stored-metadata remediation proposal.

Silo 20260903 Released

Thu, 03 Sep 2026 00:00:00 +0000

Status on 2026-09-13: this remains the latest published Server; its dependencies have not changed. Later security, storage and dependency fixes are on main, including the unreleased SN-2026-011 fix. New standalone mcli/pkg releases do not replace this artifact’s contents; see the component matrix.

Version date: 2026-09-03 · Published: 2026-09-04 · Version: RELEASE.2026-09-03T13-18-01Z · Previous release: RELEASE.2026-08-06T00-00-00Z

SILO 20260903 is the security and correctness release following the first fully rebranded Silo release. Its main theme is not a new delivery surface but a tighter set of server invariants: client headers do not create replication authority, browser origins cannot trigger bucket-metadata I/O before authentication, concurrent bucket-configuration writers cannot silently overwrite one another, and authorization and checksum behavior more closely match AWS S3.

Explicit Version Deletes Now Require DeleteObjectVersion

Wed, 02 Sep 2026 00:00:00 +0800

Release status: this change is implemented in pgsty/silo#104, tracking issue #58. Publishing this note does not by itself mean that a server release, package, image, or deployment contains the change.

SILO now maps object-delete authorization to the operation the request will actually perform:

Request	Required action
No `versionId`	`s3:DeleteObject`
Version UUID	`s3:DeleteObjectVersion`
Explicit `versionId=null`	`s3:DeleteObjectVersion`
`DeleteObjects`	The mapping is applied independently to every XML entry

Previously, SILO required s3:DeleteObject for every case and used s3:DeleteObjectVersion only as an explicit-deny check. A principal holding only DeleteObject could therefore permanently remove a named historical version. Conversely, a least-privilege purge principal holding only DeleteObjectVersion could not perform the operation it was intended for.

Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for PR #196’s HTTP deadline repair (fix 055030ea5): the connection wrapper’s rolling deadline overwrote every absolute read-header deadline, and the –read-header-timeout flag was never wired into the server. Covers the two timeout classes, the configuration matrix, what HTTP/1, HTTP/2, and TLS each get, and why the rejected alternatives would have killed long uploads.

mcli 20260903 Released

Thu, 03 Sep 2026 15:39:20 +0800

Published: 2026-09-03 · Version: RELEASE.2026-09-03T07-13-05Z · Source: a2ef95c0

Twenty-eight days after mcli 20260806, this release carries everything the client accumulated since. The toolchain moves to Go 1.27.1 and the shared dependency stack is aligned with the SILO family, with silo-pkg imported under its own module path so go.mod says what the binary is built from. The first genuinely new command since the fork arrives — mcli checksum verify, a read-only audit of stored S3 additional checksums against the bytes an endpoint actually returns. The panic that made --json admin prometheus metrics unusable is fixed, as is the response double-close that could panic after mcli sql had printed valid rows. And every path that can print a credential — --debug traces, admin trace, error messages, JSON error documents, checksum reports — was rewritten fail-closed after adversarial review. The release process changed as much as the code: artifacts come from a GPG-signed tag at the exact tip of main with green CI for that commit, ship LICENSE, NOTICE, and a generated CREDITS in every format, carry Sigstore build provenance, and land in an immutable GitHub release.

Conditional DELETE: Why the Condition Must Be Evaluated Once

Wed, 26 Aug 2026 00:00:00 +0000

SILO PR #12 attempted to add If-Match to DeleteObject, but evaluated the condition independently in every storage pool, allowing a 412 response after a partial deletion or a stale copy to reappear after success. This record documents the defect, AWS contract, counterexamples, minimal repair, test requirements, and follow-up boundary for batch conditions and policy enforcement.

DSN-Only Database Notifications: A Compatibility Boundary for #53

Sun, 23 Aug 2026 00:00:00 +0000

SILO will keep PostgreSQL and MySQL notification targets, but standardize their configuration on complete connection strings. Pre-KV discrete database fields are an unsupported migration input and must abort server startup with an explicit error instead of being accepted and silently disabling every bucket notification.

Preview Text, Never Execute It: SILO Console Text Preview PRD

Sun, 23 Aug 2026 00:00:00 +0000

The accepted PRD for previewing small log, text, JSON, and XML objects in SILO Console as bounded, strict UTF-8 text—never as a same-origin executable document.

mcli 20260806 Released

Thu, 06 Aug 2026 00:00:00 +0000

Published: 2026-08-06 · Version: RELEASE.2026-08-06T00-00-00Z

Two days after mcli 20260804, this release completes the client’s transition to the Silo identity. It is deliberately a pure rebranding and lockdown release: --version and --help now present the Silo client, every remaining path to MinIO’s SUBNET service is disabled at build time, the embedded vendor encryption key is removed from the diagnostics tooling, and the contribution policy moves to no-CLA with a mandatory DCO sign-off. There are no dependency changes and no protocol changes in this cycle — go.mod is byte-for-byte identical to 20260804 — so the regression surface is confined to text, command gating, and CI.

Silo 20260806 Released

Thu, 06 Aug 2026 00:00:00 +0000

Version: RELEASE.2026-08-06T00-00-00Z · Commit: 3be10fcc1a44f6620ded0bd303461f9d688cca23

SILO 20260806 is the first release published under the Silo name. The previous release, 20260804, was the last one delivered as pgsty/minio; this release completes the cutover to github.com/pgsty/silo and renames every delivery surface — binary, packages, container images, systemd unit, Helm chart — while deliberately preserving every wire and configuration surface a MinIO deployment depends on. On top of the rename it adds native health checking (silo healthcheck), a single-binary distroless container image pilot, complete license-compliance materials in every artifact, and a release pipeline gated on compatibility snapshots and build provenance.

Silo 20260804 Released

Wed, 05 Aug 2026 00:00:00 +0000

Version: RELEASE.2026-08-04T00-00-00Z · Commit: d88f46ccee345a9c2fabe2d221d9a9e56bc11aec

SILO 20260804 is a security, correctness, and release-engineering update to the pgsty/minio community fork. It completes the internode storage-containment work begun with CVE-2026-42600, prevents request-controlled values from impersonating server-calculated S3/IAM policy conditions, restores streaming flush behavior, fixes several multipart and versioning edge cases, hardens notification configuration migration, moves the build baseline to Go 1.26.5, and connects the server to the SILO-maintained Console, shared package, and mcli releases. The release pipeline was rebuilt to produce reproducible binaries and GPG-signed packages.

mcli 20260804 Released

Tue, 04 Aug 2026 00:00:00 +0000

Published: 2026-08-04 · Version: RELEASE.2026-08-04T00-00-00Z

This is the first release of the pgsty/mc community fork since 20260417. It fixes a credential leak in debug logging, severs every remaining connection between the client and upstream release channels, moves containers and packages onto artifacts this fork builds itself, and migrates packaging from MinIO’s pkger to standard nFPM — with GPG-signed RPMs for the first time.

Upstream minio/mc was archived in July 2026. Its final commit, 77f82e18, is exactly this fork’s base, and upstream never cut a release containing it — so this build is strictly newer than any official mc binary ever published.

Silo 20260618 Released

Thu, 18 Jun 2026 00:00:00 +0000

Published: 2026-06-18 · Version: RELEASE.2026-06-18T00-00-00Z

This release is a security and dependency-maintenance update for the pgsty/minio fork. It hardens LDAP STS throttling, completes S3 Select oversized-record enforcement, removes the obsolete ReadMultiple internode storage-REST API, upgrades the Go build baseline to 1.26.4, and refreshes Go module dependencies to pick up additional third-party security fixes.

Note

Note

Known issue: this release — like every earlier community release since RELEASE.2025-12-03T12-00-00Z — carries a silent streaming-flush regression inherited from upstream that breaks mc watch / bucket-notification listeners and S3 Select keep-alives. There is no workaround. The fix was merged to master on 2026-07-29 but has not shipped in a published server release; see PR #34 for the implementation.

MinIO Fork, Promise Kept

Fri, 17 Apr 2026 00:00:00 +0000

Two months after forking MinIO, pgsty/minio ships patches for four CVEs and related security issues. No new features — just working builds, a restored console, and timely security fixes.

CVE-2026-32285: The jsonparser Advisory That Required No Patch

Wed, 15 Apr 2026 00:00:00 +0000

Status: Closed without a code change
GitHub issue: pgsty/minio#26

Security maintenance is not always a sequence of “find a vulnerability, then ship a patch.” The initial assessment of CVE-2026-32285 was that the repository might still carry a vulnerable jsonparser; replacing the dependency or maintaining another fork was even considered. Checking the resolved module version and actual reachability changed the conclusion: the tree already used v1.1.2, which contained the fix, and govulncheck found no reachable vulnerable symbol.

Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

Wed, 16 Sep 2026 00:00:00 +0000

What the Go 1.27 toolchain move changed at the TLS layer, how to diagnose an OIDC discovery failure by phase, and which health endpoint actually reports an offline identity provider. Written from the investigation of issue #154: mechanisms verified by synthetic experiments, with the customer-side root cause explicitly left unconfirmed.

No I/O Before Auth, No Privilege From Headers

Tue, 01 Sep 2026 00:00:00 +0000

A pre-authentication CORS lookup turned arbitrary path segments into metadata I/O and cache entries, while a client-controlled replication marker acquired privileges across SSE-C reads, source timestamps, checksums, object lock, events, and deletes. This record defines SILO’s resident-only CORS hot path, two-level replication trust model, post-signature sanitization boundary, wire-compatibility matrix, and release evidence.

One Endpoint, Two Privileges: Separating User and Group Status

Wed, 26 Aug 2026 00:00:00 +0000

Shared user and group status endpoints historically checked their Enable action even for disable requests. This record explains the least-privilege defect, SILO’s strict target-state authorization design, the user repair merged through PR #73, the group follow-up, four-way IAM tests, and the boundary between committed code and a delivered release.

Config Environment Files Are Not Shell Scripts

Fri, 28 Aug 2026 00:00:00 +0000

MINIO_CONFIG_ENV_FILE is parsed directly by SILO, not sourced by a shell. A shell-identifier check therefore rejected valid named configuration targets such as my-hook. This record defines the compatible key grammar, whitespace and quoting rules, failure behavior, security boundary, and regression tests.

Two SSE-C Keys, One CopyObject Response

Fri, 28 Aug 2026 00:00:00 +0000

CopyObject can carry one SSE-C key for the source and another for the destination. SILO stored the destination checksum correctly but tried to decrypt it for the response with the source key, silently omitting checksum fields. This record explains the key-context boundary, response-only repair, single-decryption design, and regression matrix.

Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

Tue, 25 Aug 2026 00:00:00 +0000

SILO persisted the right multipart checksum and could report its type through HEAD and other APIs, but CompleteMultipartUpload dropped ChecksumType from its XML result. This record explains the defect, why PR #57 fixes it with two production lines, the review findings, the CI and merge decision, compatibility impact, and the remaining release boundary.

When the Total Is Unknown: Folder Download Progress

Sun, 23 Aug 2026 00:00:00 +0000

Status: Shipped in SILO Console 2.2.0 (16960f7ab); the server embeds it since its Console pin was updated (4d6e1ea8e) · Priority: P1 · Owner: pgsty/silo-console · Related issue: pgsty/silo#62 · PRD review: Claude Fable 5 (xhigh) — APPROVE · Implementation review: Claude Fable 5 (xhigh), 2026-08-23 — APPROVE, no P0/P1/P2 findings

SILO Console shows NaN% in Downloads / Uploads while downloading a folder. The ZIP normally keeps streaming and the stored objects are intact, but the progress bar has crossed from “unknown” into an invalid determinate state. Users see a full-looking bar, assume the transfer failed or finished, and retry it.

Silo 20260417 Released

Fri, 17 Apr 2026 00:00:00 +0000

Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z

This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the Snowball upload path, and multiple dependency- and Go toolchain-related security issues, while also incorporating the LDAP TLS regression fix and a cleanup of community-fork documentation.

Major Changes

Tighten the identity-authentication flow: OIDC / WebIdentity now accepts only asymmetrically signed ID Token values backed by the IdP JWKS; symmetrically signed tokens such as HS256 are no longer accepted. LDAP STS also now hides the distinction between unknown-user and bad-password failures to reduce username-enumeration risk.
Update LDAP STS rate limiting: limits now apply to both source IP and normalized username, and successful requests no longer consume quota incorrectly. By default MinIO now uses only the socket peer address as the source and no longer trusts X-Forwarded-For, X-Real-IP, or Forwarded; to rate-limit by real client IP, configure MINIO_IDENTITY_LDAP_STS_TRUSTED_PROXIES explicitly.
Make upload and write paths stricter: presigned query parameters can no longer be combined with unsigned-trailer PUT or multipart uploads. Snowball auto-extract now also performs full signature validation on the unsigned-trailer path and rejects anonymous or forged-signature requests.
Prevent replication metadata spoofing: internal X-Minio-Replication-* headers attached to ordinary PUT / COPY requests are now rejected or ignored, and only trusted replication flows may write the related internal metadata.
Clarify S3 Select error semantics: oversized CSV and line-delimited JSON records now return OverMaxRecordSize directly instead of the generic InternalError; clients or alerting rules that depend on the old error code should be adjusted.
Upgrade the runtime and dependency baseline: fix the regression where ldaps:// did not correctly apply TLS settings, replace minio/pkg/v3 with pgsty/minio-pkg/v3, and pin several critical dependencies that are prone to breaking changes. The release also upgrades go-jose, go.opentelemetry.io, and Go 1.26.2 to unify the build and release baseline.
Refresh documentation and security guidance: update SECURITY.md, VULNERABILITY_REPORT.md, docs/sts/ldap.md, and related documents, add a security advisory index, and switch upstream minio/minio references in the security guidance over to pgsty/minio.

Fixed CVEs

CVE-2026-34986: upgrade go-jose to v4.1.4 and fix known security issues in the JWT / JOSE dependency chain.
CVE-2026-39883: upgrade the go.opentelemetry.io dependency stack to fix the PATH-hijacking risk.
CVE-2026-33322: restore the strict JWKS-only OIDC JWT verification path to block keyring injection and algorithm-confusion risk.
CVE-2026-33419: systematically harden LDAP STS authentication, rate limiting, source-address identification, and accounting logic across four follow-up fixes.
CVE-2026-34204: reject injection of X-Minio-Replication-* metadata by untrusted requests to prevent objects from being written with invalid replication state.
CVE-2026-39414: reject oversized S3 Select records early to avoid continued buffering and parsing of abnormal inputs.
GHSA-hv4r-mvr4-25vw: close the unsigned-trailer query-auth bypass.
GHSA-9c4q-hq6p-c237: harden unsigned-trailer authentication and signature validation in Snowball auto-extract scenarios.
CVE-2026-32280, CVE-2026-32281, and CVE-2026-32283: upgrade Go to 1.26.2 and absorb the upstream toolchain and stdlib security fixes.

c878ca0: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
e970ec5: fix: upgrade go-jose to v4.1.4 to patch CVE-2026-34986
a206510: fix: CVE-2026-39883 upgrade go.opentelemetry.io
fd65f11: merge: PR #18 upgrade go-jose to v4.1.4 for CVE-2026-34986
bc087e4: merge: PR #19 upgrade go.opentelemetry.io for CVE-2026-39883
f1f2239: fix: CVE-2026-33322 restore JWKS-only OIDC JWT verification
6619d0c: fix: CVE-2026-33419 harden LDAP STS auth
fcb8f24: fix: CVE-2026-34204 reject untrusted replication metadata
c5765dc: fix: CVE-2026-39414 reject oversized S3 Select records
f444b6f37: fix: fake CVE-2026-40027 block unsigned-trailer query auth bypass
efb6e5b00: fix: fake CVE-2026-40028 harden snowball unsigned-trailer auth
9a4b3cd: fix: CVE-2026-32280/CVE-2026-32281/CVE-2026-32283 upgrade Go to 1.26.2
c55b52c: fix: CVE-2026-33419 preserve LDAP STS rate limits on success
817a457: fix: CVE-2026-33419 harden LDAP STS rate-limit source IP
084a154: fix: CVE-2026-33419 tighten LDAP STS rate-limit accounting
16e34f9: docs: refresh security guidance and fork references

CVE-2026-33322: OIDC JWT Algorithm Confusion

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants
GitHub issue: pgsty/minio#22

The old implementation placed the OIDC client secret in the JWT verifier keyring while also accepting HMAC signing methods. An attacker who knew that client secret could therefore mint an HS-signed token and exchange it through STS for temporary credentials. The final fix restored asymmetric, JWKS-only verification. It deliberately broke HS256/384/512 compatibility instead of keeping an option that would reintroduce ambiguous trust semantics.

MinIO Is Dead, Long Live MinIO

Sat, 14 Feb 2026 00:00:00 +0000

MinIO’s repo is officially archived and abandoned. And how AI Agents helped bring it back from the dead. This post explains how a community fork restores the admin console and ships binaries via CI/CD pipeline.

A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

Wed, 26 Aug 2026 00:00:00 +0000

Three ListObjects shortcuts return EOF before touching storage, causing a missing bucket to appear as an empty listing. This record explains the SILO #32 / PR #37 regression, S3 compatibility value, minimal shortcut-only existence check, cluster fan-out cost, derived risks, and acceptance decision.

Read-Only Checksum Audit and Reliable CLI Output

Sat, 29 Aug 2026 00:00:00 +0000

MCLI can audit stored S3 checksums against logical object bytes without mutating data. This record defines selection, classification, report and exit semantics, and the non-TTY output contract required by pipelines and CI.

Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

Mon, 24 Aug 2026 00:00:00 +0000

SILO required every part in a checksum-enabled multipart upload to carry a per-part checksum. That rejected ordinary UploadPart requests that omitted an optional header and made UploadPartCopy unusable. This record covers discovery, AWS and AIStor research, rejected designs, the one-pass plaintext solution, the compatibility-baseline blocker, adversarial review, and the consistency contract for follow-up repairs.

CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released, followed by two rounds of corrections
First containing release: RELEASE.2026-04-17T00-00-00Z
Complete correction: RELEASE.2026-06-18T00-00-00Z
GitHub issue: pgsty/minio#23

The core vulnerability was straightforward: LDAP STS returned different results for “user does not exist” and “password is wrong,” creating a username oracle. The first fix unified the external authentication failure and added limits by source IP and username. Continued review then showed that success refunds, spoofable source headers, reservation accounting, and the shared username bucket could turn the security control itself into a new attack surface.

Silo 20260325 Released

Wed, 25 Mar 2026 00:00:00 +0000

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z

This is a maintenance release centered on packaging, stability, and security disclosure. It improves the shipping artifacts, fixes an LDAP TLS regression, and explicitly documents the secure dependency set carried by the release.

Major Changes

Bundle mcli/mc into the Docker image and add checksum verification for a better out-of-the-box image experience.
Fix the LDAP TLS regression affecting ldaps:// deployments so TLS settings are correctly honored.
Remove inherited upstream CI/CD workflows that are no longer used in the community-maintained fork.
Pin several critical dependencies to avoid further fallout from upstream breaking changes.

Fixed CVEs

CVE-2026-24051: the release notes explicitly call out go.opentelemetry.io/otel/sdk v1.42.0, which avoids the macOS PATH-hijacking arbitrary code execution issue.
CVE-2025-10543: the release notes explicitly ship github.com/eclipse/paho.mqtt.golang v1.5.1, fixing incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2025-58181: the release notes explicitly ship golang.org/x/crypto v0.49.0, fixing unbounded memory consumption in ssh GSSAPI authentication handling.

f2f9a40: add mcli/mc from pgsty/mc to Docker image
ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
ee55e53: remove upstream CI/CD workflows inherited from minio/minio

MinIO Is Dead. Which Next?

Mon, 08 Dec 2025 00:00:00 +0000

MinIO just entered maintenance mode. What replaces it? Can RustFS step in? I tested the contenders so you don’t have to.

BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

Thu, 27 Aug 2026 00:00:00 +0000

SILO rejected three invalid CompleteMultipartUpload requests, but returned the wrong S3 error codes and missed checksum-type validation paths. This record establishes the AWS evidence, upstream history, operation-scoped repair, type-only follow-up, regression matrix, and the separate evidence gate for CRC64NVME plus COMPOSITE.

Should SILO Fix ListMultipartUploads? Design Review of Issue #79

Sun, 30 Aug 2026 00:00:00 +0000

SILO treats ListMultipartUploads prefix as an exact object key and uses a node-local volatile cache for bucket-wide listing. This record explains the defect and its sources, evaluates the compatibility and operational impact, compares four response and storage options, and recommends a staged metadata-plus-scan repair rather than either a cosmetic cache patch or an immediate durable index.

CVE-2026-34204: Replication Metadata Injection

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub issue: pgsty/minio#24

Ordinary PUT and COPY requests could smuggle X-Minio-Replication-* headers into internal X-Minio-Internal-* SSE metadata, creating objects whose replication state did not match the authorized path and could even make them unreadable. The final fix stopped accepting replication-only metadata by default, restored it only in a trusted flow authorized for ReplicateObjectAction, and sanitized CopyObject before any header consumer ran.

Threat model

An attacker needed only ordinary object-write permission, not internode credentials. The input came entirely from client-controlled X-Minio-Replication-* headers, but metadata extraction converted it into internal replication or SSE state.

Silo 20260321 Released

Sat, 21 Mar 2026 00:00:00 +0000

Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z

This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most substantial security dependency refresh in the current release line.

Major Changes

Upgrade the build environment from Go 1.26.0 to Go 1.26.1.
Refresh direct and indirect dependencies to converge on the newer toolchain.
Fix linter and test issues exposed by the stricter Go 1.26.1 checks.

Fixed CVEs

CVE-2026-27137: Go stdlib 1.26.0 -> 1.26.1 fixes incomplete email-constraint enforcement in crypto/x509.
CVE-2026-27138: Go stdlib 1.26.0 -> 1.26.1 fixes a crypto/x509 panic triggered by malformed certificates.
CVE-2026-25679: Go stdlib 1.26.0 -> 1.26.1 fixes insufficient validation of IPv6 host literals in net/url.
CVE-2026-27139: Go stdlib 1.26.0 -> 1.26.1 fixes FileInfo metadata escaping the Root boundary in os.
CVE-2026-27142: Go stdlib 1.26.0 -> 1.26.1 fixes missing URL escaping in html/template for meta refresh content.
CVE-2026-26958: filippo.io/edwards25519 v1.1.0 -> v1.2.0 fixes incorrect or undefined MultiScalarMult behavior.
CVE-2025-10543: github.com/eclipse/paho.mqtt.golang v1.5.0 -> v1.5.1 fixes incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2026-24051: go.opentelemetry.io/otel/sdk v1.38.0 -> v1.42.0 fixes the macOS PATH-hijacking arbitrary code execution issue.
CVE-2026-33186: google.golang.org/grpc v1.77.0 -> v1.79.3 fixes authorization bypass caused by a missing leading slash in the HTTP/2 :path pseudo-header.

5abd9a8: bump golang to 1.26.1 and update deps
377fc61: fix: satisfy stricter Go 1.26.1 linter checks

MinIO is Dead

Thu, 04 Dec 2025 00:00:00 +0000

MinIO announces it is entering maintenance mode, the dragon-slayer has become the dragon – how MinIO transformed from an open-source S3 alternative to just another commercial software company

CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released; the second-round fix was completed in June
Initial fix release: RELEASE.2026-04-17T00-00-00Z
Complete fix release: RELEASE.2026-06-18T00-00-00Z
GitHub issue: pgsty/minio#25

The first fix in April reused the existing 1 MiB maxCharsPerRecord limit for both CSV and ordinary JSON Lines. This prevented unbounded buffering while waiting for a delimiter and returned the explicit OverMaxRecordSize error to clients. A June review then found that CPUs with SIMD support took a different simdjson fast path that bypassed the limit completely.

Silo 20260314 Released

Sat, 14 Mar 2026 00:00:00 +0000

Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z

This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases.

Major Changes

Switch to the community-maintained georgmangold/console v1.9.1 fork in place of the unmaintainable upstream Console dependency.
Refresh a large portion of the direct and indirect dependency graph so the new Console and toolchain combination builds cleanly.
Fix the go vet format directive issue in grid_test.go and adjust tests for the HTTP behavior changes in Go 1.26.

Fixed CVEs

CVE-2025-47913: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent when handling malformed responses.
CVE-2025-58181: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes unbounded memory consumption in ssh GSSAPI authentication parsing.
CVE-2025-47914: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent caused by malformed identity messages.
CVE-2025-47911: golang.org/x/net v0.39.0 -> v0.48.0 fixes quadratic parsing complexity in html.Parse for crafted inputs.
CVE-2025-58190: golang.org/x/net v0.39.0 -> v0.48.0 fixes an infinite parsing loop in golang.org/x/net/html.

68521b3: add github ci/cd pipeline
00f3cf7: RELEASE.2026-03-14T12-00-00Z with go 1.26.0

CVE-2026-40344: Snowball Auto-Extract Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-9c4q-hq6p-c237

Snowball’s PutObjectExtractHandler omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature could enter untar() before authentication completed, and one request could fan out into many object writes. The final fix initialized the correct reader, handled the decoded length, and completed SigV4 verification before any tar byte reached the extractor.

Why the identifier changed

The official CVE had not been assigned when the fix was written, so the commit subject used the temporary identifier fake CVE-2026-40028. The final identifier is CVE-2026-40344. The historical commit was not rewritten; the advisory and this article use the official number.

Silo 20260214 Released

Sat, 14 Feb 2026 00:00:00 +0000

Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z

This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security fixes from the older toolchain generation.

Major Changes

Restore the embedded Console and refresh the README to clarify the community fork position.
Add GitHub CI/CD workflows as the base for automated builds and multi-platform delivery.
Add quick links for docs, Docker, the GitHub repository, and installation through the pig package manager.

Fixed CVEs

These issues were absorbed as part of the Go 1.25.5 -> 1.26.0 upgrade:

CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-hv4r-mvr4-25vw

Query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER data flow, while the old code verified the signature only when an Authorization header was present. A request carrying a valid access-key identifier could therefore complete a write without a correct signature.

The final fix moved presigned rejection and SigV4 verification into newUnsignedV4ChunkedReader(), making every caller consuming that stream share one authentication boundary.

Identifier note

The official CVE had not been assigned when the patch was written, so its commit subject used fake CVE-2026-40027. The final identifier is CVE-2026-41145. The historical commit remains unchanged; public material uses the official identifier.

Silo 20251203 Released

Mon, 15 Dec 2025 00:00:00 +0000

Published: 2025-12-15 · Version: RELEASE.2025-12-03T12-00-00Z

This is the earliest traceable community release. Its purpose is to establish the community packaging and distribution baseline rather than to deliver incremental fixes over an earlier community release.

Major Changes

Build the community packaging flow around minio/pkger.
Choose a maintenance-mode upstream MinIO baseline as the starting point for the community-maintained fork.
Produce the first apk, deb, and rpm artifacts for ongoing community releases.

Fixed CVEs

This is the first community release. The GitHub Release does not provide a delta-style security-fix list against an earlier community version, and this page does not attempt to reconstruct the full historical CVE delta against the upstream maintenance baseline.

d4cd4b4: RELEASE.2025-12-03T12-00-00Z with go 1.25.5

CVE-2026-42600: ReadMultiple Storage-REST Path Traversal

Fri, 12 Jun 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-06-18T00-00-00Z
GitHub advisory: GHSA-xh8f-g2qw-gcm7
Affected scope: Distributed erasure only; cluster-root / internode JWT required

The msgpack body of /rmpl carried Bucket, Prefix, and Files. The old code joined those values into filesystem paths without a containment check. The initial fix implemented full preflight validation. Continued call-chain review then found that this API had had no production caller since 2024. The final solution changed from “retain and harden” to removing the route, handler, client, interface, and generated code.

Internode Path Containment Audit: Paying Off What CVE-2026-42600 Left Owing

Sun, 02 Aug 2026 00:00:00 +0000

Release status (verified 2026-09-13): the primary fix in this article is included in 20260804 and later releases. The investigation below retains its original test boundaries; see the component matrix for current unreleased work. Affected scope: Distributed erasure only; cluster-root / internode JWT required Prerequisite reading: CVE-2026-42600 · ReadMultiple

This article is now public. The primary fix shipped as recorded above; residual findings below are the investigation-time record, not a claim that publishing one fix closed the entire defect class.

The Parser Knew, the Schema Didn't: Config Keys That Could Take Every Notification Down

Tue, 04 Aug 2026 00:00:00 +0000

Release status (verified 2026-09-13): the primary fix in this article is included in 20260804 and later releases. The investigation below retains its original test boundaries; see the component matrix for current unreleased work. Classification: Configuration-schema consistency and availability, not a vulnerability; includes one defensive hardening (credential values no longer echoed in validation errors) Affected scope: notify_nats JWT/NKey/TLS-handshake-first options, notify_amqp immediate, and any pre-2020 config migrated with an enabled NATS target — whose failure then silences every notification backend Tracking: pgsty/minio issue #39

Object Grant, Bucket Reach: When 'bucket/*' Could Rewrite the Bucket Itself

Tue, 04 Aug 2026 00:00:00 +0000

Status: Fixed on pgsty/silo-pkg main (3c24ad1, extended by 1f97549, scoped to its final twelve actions in d8b1fa7), released as silo-pkg v3.11.0; consumed by pgsty/minio Classification: Access-control hardening — a privilege boundary, narrowly restored Affected scope: IAM users/roles/service accounts granted only object-scoped (arn:aws:s3:::bucket/*) access, in deployments that share a cluster across tenants Tracking: upstream minio/minio issue #20449 (public since 2024, still open)

Conclusions first

In IAM policy matching, a bucket-level request carries an empty object name, and the matcher built its resource string as "bucket/". An object-only policy pattern — "arn:aws:s3:::bucket/*" — then matched that string, so a grant that should cover only objects also authorized bucket-level actions.
The dangerous one is PutBucketPolicy. A tenant holding only s3:* on bucket/* could install a bucket policy with Principal:"*" — making the bucket publicly readable or writable — or grant itself bucket-level control. Same mechanism, same class: DeleteBucket/ForceDeleteBucket (the issue’s own reproduction), PutReplicationConfiguration (exfiltration), PutBucketLifecycle (mass deletion), PutBucketVersioning, PutBucketObjectLockConfiguration, and the rest of the bucket-configuration writes.
The full correction is a two-directional behavior change: it tightens over-granting Allow statements and loosens over-blocking Deny statements, and it would revoke ListBucket/GetBucketLocation grants that many real deployments write as bucket/* today. That is a compatibility break, not a clean patch.
So we shipped a narrow fix — first six sensitive bucket-configuration writes, then, in a second pass, twelve: the bucket-level writes that hand the caller something its object access does not already give it, plus four that no handler implements. Only on Allow statements, so no Deny and no NotResource exclusion is ever weakened, with an environment-variable escape hatch. The compatibility-sensitive read/list family, CreateBucket, and three bucket writes with plausible tenant use are left unchanged, by decision.
Twice we claimed the change could only remove permissions, and twice an untested case said otherwise — the second time found by an independent review of a shipped release. The protected path now requires the resource to match both the bare and the historical form, which makes the property hold by construction rather than by argument.
The fix is red/green proven at the matcher layer and end to end through the real handlers; the object-scoped hot path is untouched.

The slash, and the empty object name

Every bucket-level S3 operation authorizes with an empty object name — checkRequestAuthType(ctx, r, policy.PutBucketPolicyAction, bucket, ""). The IAM matcher turned that into a resource string, and for the empty-object case it appended a trailing slash:

Absent Is Not Empty: A Blank versionid and the Fail-Open It Invites

Tue, 04 Aug 2026 00:00:00 +0000

Release status (verified 2026-09-13): the primary fix in this article is included in 20260804 and later releases. The investigation below retains its original test boundaries; see the component matrix for current unreleased work. Classification: Policy-enforcement correctness — a fail-closed report, a fail-open trap avoided, and one narrow trim bypass closed. Not a headline CVE — see How we classify this Affected scope: Any deployment with a bucket/IAM policy using Null or StringEquals on s3:versionid; the reported break is on DeleteObject/DeleteObjects Tracking: upstream minio/minio issue #21735 (reporter iTrooz, 2026-01-10); upstream repository archived read-only since 2026-04-25

Three Headers, One Lie: Making the Client Source Address Mean Something

Tue, 04 Aug 2026 00:00:00 +0000

Release status (verified 2026-09-13): the primary fix in this article is included in 20260804 and later releases. The investigation below retains its original test boundaries; see the component matrix for current unreleased work. Classification: Opt-in hardening plus a documentation defect, not a vulnerability and not a regression; no CVE assigned. The underlying weakness is inherited from upstream and its default behaviour is unchanged here Affected scope: aws:SourceIp policy conditions, the audit log remotehost field, S3 event notification Host, and the client shown by mc admin trace — on any deployment whose S3 API port is reachable without passing through a header-sanitising proxy Upstream: nothing to file — minio/minio is archived. Prior art there: PR #4736 (2017, the concern raised and half-addressed), discussion #17878 (2023, maintainer marks it working as intended), PR #20977 (2025, the partial switch)

Sorted Is Not Increasing: How One Duplicate Part Number Doubled an Object

Mon, 03 Aug 2026 00:00:00 +0000

This article is now public. The primary fix shipped as recorded above; residual findings below are the investigation-time record, not a claim that publishing one fix closed the entire defect class.

PGSTY SILO Blog on SILO

SILO Console 2.4.1 Released

Shared downloads

mcli 20260916 Released

Changes since 20260913

Automation and upgrade notes

mcli 20260913 Released

Changes since 20260903

silo-pkg 3.14.0 Released

Password-policy migration

SN-2026-011: Fix and Release Status

SILO Console 2.4.0 Released

Released behavior

Silo Console 2.2.0 Release Notes

Silo Console 2.1.0 Released

Silo Console 2.0.0 Released

silo-pkg 3.13.0 Released

silo-pkg 3.12.0 Released

Silo Pkg 3.11.0 Released

What This Repository Is

CVE-2025-62506: Session-Policy Privilege Escalation

Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

An Unsigned Header Is Not Part of the Request

Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

SILO 20260903 Security Notes: SN-2026-006 through 010

SILO Server 20260903 Pre-release Review

Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

Silo 20260903 Released

Explicit Version Deletes Now Require DeleteObjectVersion

Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

mcli 20260903 Released

Conditional DELETE: Why the Condition Must Be Evaluated Once

DSN-Only Database Notifications: A Compatibility Boundary for #53

Preview Text, Never Execute It: SILO Console Text Preview PRD

mcli 20260806 Released

Silo 20260806 Released

Silo 20260804 Released

mcli 20260804 Released

Silo 20260618 Released

MinIO Fork, Promise Kept

CVE-2026-32285: The jsonparser Advisory That Required No Patch

Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

No I/O Before Auth, No Privilege From Headers

One Endpoint, Two Privileges: Separating User and Group Status

Config Environment Files Are Not Shell Scripts

Two SSE-C Keys, One CopyObject Response

Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

When the Total Is Unknown: Folder Download Progress

Silo 20260417 Released

Major Changes

Fixed CVEs

Related Commits

CVE-2026-33322: OIDC JWT Algorithm Confusion

MinIO Is Dead, Long Live MinIO

A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

Read-Only Checksum Audit and Reliable CLI Output

Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain

Silo 20260325 Released

Major Changes

Fixed CVEs

Related Commits

MinIO Is Dead. Which Next?

BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

Should SILO Fix ListMultipartUploads? Design Review of Issue #79

CVE-2026-34204: Replication Metadata Injection

Threat model

Silo 20260321 Released

Major Changes

Fixed CVEs

Related Commits

MinIO is Dead

CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass

Silo 20260314 Released

Major Changes

Fixed CVEs

Related Commits

CVE-2026-40344: Snowball Auto-Extract Authentication Bypass

Why the identifier changed