CVE-2026-31216 — Unauthenticated arbitrary MinIO object delete in nexent storage API

MITRE service request: 1987825

Status: RESERVED (pending a qualifying public reference per CNA Rules §5.3).

Official CVE description

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.

Summary

The storage microservice exposes DELETE /storage/{object_name:path} where object_name may include slashes, effectively letting anonymous callers delete arbitrary object keys in the configured bucket. The call chain (remove_storage_file → delete_file_impl → attachment_db.delete_file → MinIO delete_object) never verifies caller identity or object ownership.

Affected product and versions

• Product: ModelEngine-Group/nexent backend file-management surface.
• Version in coordination record: v1.7.5.2.

Technical details

• Surface: Unauthenticated DELETE /storage/<object_key>; attacker supplies a fully qualified object key such as uploads/private/secret.pdf.
• Root cause: Missing authentication/authorization and absence of path allow-lists or per-tenant prefixes before issuing delete_object against MinIO.
• Attack flow: Discover exposed API (scanning or leaked docs) → issue crafted DELETE → object permanently removed → dependent features fail.
• Blast radius: Any object key reachable in the default bucket; batch guessing of common prefixes magnifies damage.

Risk

Critical for deployments exposing the API to untrusted networks. Primary impact is integrity and availability (mass data deletion).

Remediation / workaround

• Front the API with strong authentication and rate limiting; block unauthenticated DELETE at the edge.
• Implement per-user object namespaces, signed URLs for delete, and server-side ownership checks before calling MinIO.