OpenAI, MinIO, And Why You Should Always Use docker-cli-scan To Keep Your Supply ch AIn Clean
Summary: OpenAI's example code for its new ChatGPT plugin feature uses a MinIO Docker image, RELEASE.2022-03-17, that is vulnerable to CVE-2023-28432, which discloses all environment variables including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. GreyNoise says it has no information that any actor is targeting ChatGPT example instances specifically, but has observed the vulnerability actively exploited in the wild, and it recommends upgrading to MinIO RELEASE.2023-03-20T20-16-18Z and adding tooling such as docker-cli-scan or GitHub's built-in supply chain monitoring.
Bottom line: Developers copying vendor example code inherit its flaws, and this one exposes root credentials to anyone who can reach the service - a mass-exploitation target that lands inside whatever the plugin touches.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-28432
- Related
- CVE-2023-28432: MinIO Information Disclosure Vulnerability Known Exploited Vulnerabilities · Apr 21, 2023New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026