Security

A CVE was reported Privilege Escalation via Session Policy Bypass in Service Accounts and STS and fixed in this release,

All users are advised to download and upgrade their MinIO setup immediately.

To install the latest release

go install -v github.com/minio/minio@latest

OR

go install -v github.com/minio/[email protected]

For container environments, please clone the source and build the latest container.

git clone https://github.com/minio/minio
git checkout RELEASE.2025-10-15T17-29-55Z
TAG=myregistry.com/minio/minio:RELEASE.2025-10-15T17-29-55Z make docker

What's Changed

• fix: remove unnecessary replication checks by @0xMALVEE in #21569
• LDAP TLS handshake fails with StartTLS and tls_skip_verify=off by @mosesdd in #21582
• fix: incorrect poolID when after decommission adding pools by @jiuker in #21590
• fix: after saveRebalanceStats cancel will be empty by @jiuker in #21597
• Use new gofumpt by @klauspost in #21613
• fix: timeN function return final closure not be called by @drivebyer in #21615
• Updating readme for MinIO docs by @ravindk89 in #21625
• Update README with Docker and Helm installation instructions by @ravindk89 in #21627
• Bump Go version in toolchain directive to 1.24.8 by @marktheunissen in #21629
• fix: allow trailing slash in AWS S3 POST policies by @cduzer in #21612
• Change documentation link in README by @ravindk89 in #21636
• fix: check sub-policy properly when present by @donatello in #21642

New Contributors

• @mosesdd made their first contribution in #21582
• @cduzer made their first contribution in #21612

Full Changelog: RELEASE.2025-09-07T16-13-09Z...RELEASE.2025-10-15T17-29-55Z