CVE-2026-33419
LDAP Credential Brute-Force in MinIO STS Enables Unauthorized Access
Publication date: 2026-03-24
Last updated on: 2026-04-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| minio | minio | to 2026-03-17t21-25-16z (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects MinIO AIStor's Security Token Service (STS) AssumeRoleWithLDAPIdentity endpoint. It arises from two main weaknesses: first, the system provides distinguishable error responses that allow an attacker to enumerate valid LDAP usernames; second, there is no rate limiting on authentication attempts. An unauthenticated attacker can exploit these weaknesses to guess passwords unlimitedly, eventually obtaining temporary AWS-style STS credentials.
With these credentials, the attacker can gain unauthorized access to the victim's S3 buckets and objects stored in MinIO.
This vulnerability was fixed in the MinIO release RELEASE.2026-03-17T21-25-16Z.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an unauthenticated attacker to enumerate valid LDAP usernames and perform unlimited password guessing to obtain temporary security credentials.
This can lead to unauthorized access to your S3 buckets and stored objects, potentially resulting in data exposure, data theft, or data manipulation.
Such unauthorized access can compromise the confidentiality and integrity of your stored data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know