Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M
CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limit
Critical 9.1
In plain English
A critical-severity security flaw in minio from minio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/minio/minio | no fix listed | GHSA-jv87-32hw-hh99 |
| Go | github.com/minio/minio | no fix listed | GO-2026-4803 |
Affected products (as reported)
Weakness: CWE-204, CWE-307 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/minio/minio/security/advisories/GHSA-jv87-32hw-hh99 x_refsource_CONFIRM