MinIO Operator STS Audience Misconfiguration Vulnerability Allowing Token Replay

A vulnerability exists in MinIO Operator STS (Security Token Service) for Kubernetes, specifically in versions prior to 7.1.0. The issue arises when no audiences are specified for the 'spec.audiences' field, causing the default audience to be set to the Kubernetes apiserver. This lack of scoping can lead to token replay attacks on other internal systems that may inadvertently trust the token. The vulnerability has been addressed in version 7.1.0.

Impact

Exploitation of this vulnerability could result in unauthorized access to internal systems through replayed tokens, potentially leading to privilege escalation.

Remediation

Users can upgrade to MinIO Operator version 7.1.0 or later to address this vulnerability. Additionally, guidance is available on how to create audience-specific service account tokens and disable the automatic mounting of service account tokens in Kubernetes.