CVE-2025-62506: Session-Policy Privilege Escalation
Status: Inherited and released
First SILO community release: RELEASE.2025-12-03T12-00-00Z
Upstream fixed release: RELEASE.2025-10-15T17-29-55Z
GitHub advisory: GHSA-jjjj-jwhf-8rgr
Upstream fix: minio/minio#21642
A service account or STS account constrained by a restricted session policy could invoke an “own account” Admin API operation to create a child service account without the session-policy restriction. Because the policy check set DenyOnly = true for own-account operations, any session policy that lacked an explicit Deny rule allowed the call, and the newly created child service account inherited the broader permissions of the parent user.
SILO did not require a separate backport. The upstream fix and its two regression test groups were already present in the Git history from which the first SILO community release (RELEASE.2025-12-03T12-00-00Z) was cut.
Commit mapping
| Role | Repository | Commit | Evidence |
|---|---|---|---|
| Upstream remediation | minio/minio |
c1a49490 |
Merge commit for minio/minio#21642 |
| SILO inheritance | pgsty/silo |
c1a49490 |
Preserves the exact Git commit object and SHA; RELEASE.2025-12-03T12-00-00Z and all subsequent SILO releases descend from it |
The identical commit SHA establishes direct source inheritance from upstream history. The Security Advisories ledger indexes the same commit mapping.
Regression evidence
Upstream PR #21642 added two regression test groups, each exercising both root and non-root parent accounts:
TestServiceAccountPrivilegeEscalationBug2_2025_10_15(cmd/admin-handlers-users_test.go) verifies that restricted service accounts cannot escalate privileges by creating unrestricted child service accounts.TestSTSPrivilegeEscalationBug2_2025_10_15(cmd/sts-handlers_test.go) verifies the same boundary for restricted STS temporary credentials.
Both test groups run as part of the standard go test ./cmd suite.
Fix and operator boundary
Whenever a session policy (sub-policy) is attached to the caller’s credential, the policy evaluator clears the DenyOnly flag before evaluating the session policy. An own-account operation can no longer pass simply because the session policy lacks an explicit Deny; the restricted session policy must explicitly grant Allow for the action.
Every SILO release contains c1a49490. Operators migrating from an upstream MinIO build older than RELEASE.2025-10-15T17-29-55Z should upgrade to SILO, audit service accounts created by restricted service or STS identities prior to the upgrade, and revoke any unauthorized child accounts.
Related advisory: CVE-2026-32285
Several vulnerability feeds later published CVE-2026-32285 with text describing github.com/buger/jsonparser while pointing to commit c1a49490. For the dependency reachability investigation and why no code change was made for that advisory, see CVE-2026-32285: The jsonparser Advisory That Required No Patch.