CVE-2026-33419 Details
Description
MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
A vulnerability exists in MinIO AIStor's Security Token Service (STS) AssumeRoleWithLDAPIdentity endpoint, prior to RELEASE.2026-03-17T21-25-16Z. This vulnerability allows for LDAP credential brute-forcing, enabled by distinguishable error responses that permit username enumeration and a lack of rate limiting on authentication attempts. An unauthenticated network attacker can exploit this to enumerate valid LDAP usernames and perform unlimited password guessing, ultimately obtaining temporary AWS-style STS credentials. This access allows the attacker to interact with the victim's S3 buckets and objects.
Users should upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later. If an immediate upgrade is not possible, network-level rate limiting can be implemented using a reverse proxy or WAF to restrict requests to the STS AssumeRoleWithLDAPIdentity endpoint. Additionally, firewall restrictions can be applied to limit access to trusted networks or IP ranges. Configuring account lockout policies on the LDAP server can also help, although this may cause denial-of-service for legitimate users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/minio/minio/security/advisories/GHSA-jv87-32hw-hh99 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| minio minio | < 2026-03-17t21-25-16z |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |