From e9d5e30aaf95a34169d1ad99ca50ef74af8f29d2 Mon Sep 17 00:00:00 2001
From: Benedikt Ritter <beneritter@gmail.com>
Date: Tue, 17 Feb 2026 10:28:05 +0100
Subject: [PATCH] minio: mark package as insecure

Context: #490996
---
 pkgs/by-name/mi/minio/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/mi/minio/package.nix b/pkgs/by-name/mi/minio/package.nix
index 199e68f5ff9e..cb1b38d4b7fd 100644
--- a/pkgs/by-name/mi/minio/package.nix
+++ b/pkgs/by-name/mi/minio/package.nix
@@ -74,5 +74,14 @@ buildGoModule (finalAttrs: {
     ];
     license = lib.licenses.agpl3Plus;
     mainProgram = "minio";
+    knownVulnerabilities = [
+      "CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads"
+      "CVE-2026-41145: Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads"
+      "CVE-2026-33322: JWT Algorithm Confusion in OIDC Authentication"
+      "CVE-2026-33419: LDAP login brute-force via user enumeration and missing rate limit"
+      "CVE-2026-34204: SSE Metadata Injection via Replication Headers"
+      "CVE-2026-39414: DoS via Unbounded Memory Allocation in S3 Select CSV Parsing"
+      "minio has been abandoned by upstream and security issues won't be fixed. Users should migrate to alternatives such as Garage, SeaweedFS, or Ceph. S3-compatible clients such as rclone can be used to move data."
+    ];
   };
 })