CVE-2026-33419: 
MinIO vulnerability analysis and mitigation

CVE-2026-33419 is a vulnerability in MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint that enables LDAP credential brute-forcing through two combined weaknesses: username enumeration via distinguishable error responses (CWE-204) and absence of rate limiting on authentication attempts (CWE-307). It affects all MinIO open-source releases through 0.0.0-20260212201848-7aac2a2c5b7c (Go module) and all MinIO AIStor versions prior to RELEASE.2026-03-17T21-25-16Z. The vulnerability was published on March 20, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 9.1 (Critical). Only deployments with LDAP authentication configured are impacted (GitHub Advisory, MinIO Advisory).

The root cause is twofold: the STS endpoint returns distinguishable error messages depending on whether a submitted LDAP username exists (CWE-204), and no rate limiting or throttling is applied to authentication attempts against the /?Action=AssumeRoleWithLDAPIdentity endpoint (CWE-307). An unauthenticated network attacker can first probe the endpoint with candidate usernames and observe response differences to enumerate valid LDAP accounts, then launch unlimited high-speed password guessing against confirmed usernames. No authentication, special privileges, or user interaction is required — only network access to the STS endpoint and a MinIO deployment with LDAP configured (GitHub Advisory, MinIO Advisory).

Successful exploitation allows an unauthenticated attacker to obtain temporary AWS-style STS credentials (AccessKeyId, SecretAccessKey, SessionToken) with full access to the compromised LDAP user's S3 resources, including all associated buckets and objects. This results in a high confidentiality impact (unauthorized access to potentially sensitive stored data) and, per CVSS v4.0, a high integrity impact (ability to modify or delete S3 objects). Availability is not directly impacted by the vulnerability itself, though LDAP account lockout workarounds could cause denial-of-service for legitimate users (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.05% (0.026% per GitHub Advisory), placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the low EPSS, the attack requires no authentication and is fully automatable using standard HTTP tooling, making it a straightforward target if exposed publicly.

1. Reconnaissance: Identify internet-facing MinIO AIStor instances with LDAP authentication enabled using tools like Shodan or Censys, searching for MinIO service banners or the STS endpoint path /?Action=AssumeRoleWithLDAPIdentity.
2. Username enumeration: Send POST requests to the /?Action=AssumeRoleWithLDAPIdentity endpoint with candidate LDAP usernames (e.g., from a wordlist or harvested from OSINT). Observe and compare error responses — differing messages or response codes indicate whether a username is valid (CWE-204).
3. Compile valid username list: Record all usernames that return a distinguishable "user exists" response for use in the next phase.
4. Password brute-force: For each confirmed valid username, launch automated password guessing using tools such as hydra, medusa, or a custom script targeting the same STS endpoint. Since no rate limiting exists (CWE-307), attempts can be made at high speed without lockout.
5. Obtain STS credentials: Upon successful authentication, the endpoint returns temporary AWS-style STS credentials (AccessKeyId, SecretAccessKey, SessionToken).
6. Access S3 resources: Use the obtained STS credentials with standard AWS CLI or S3-compatible tools (e.g., aws s3 ls, mc) to enumerate, exfiltrate, or modify the victim user's S3 buckets and objects (GitHub Advisory, MinIO Advisory).

• Network: High volume of POST requests to /?Action=AssumeRoleWithLDAPIdentity from a single or small set of source IPs; rapid sequential requests with varying username parameters; unusual S3 API activity (listing, downloading, or modifying objects) using STS-issued credentials from unexpected IP addresses.
• Logs: MinIO access logs showing repeated failed LDAP authentication attempts with different usernames followed by a successful authentication; authentication log entries with a high ratio of failures to successes from the same source IP; STS credential issuance events for accounts not associated with normal business hours or known client IPs.
• Process/Behavior: Sudden spike in STS token issuance events; S3 data access patterns inconsistent with the legitimate user's normal behavior (e.g., bulk downloads, cross-region access, or access to buckets not typically used by that account) (GitHub Advisory).

The primary fix is to upgrade MinIO AIStor to RELEASE.2026-03-17T21-25-16Z or later, which addresses both the username enumeration and missing rate limiting issues. For deployments that cannot upgrade immediately, the following workarounds are recommended:

• Network-level rate limiting: Deploy a reverse proxy (e.g., nginx, HAProxy) or WAF to rate-limit requests to the /?Action=AssumeRoleWithLDAPIdentity endpoint.
• Firewall restrictions: Restrict access to the STS endpoint to trusted IP ranges or internal networks only.
• LDAP account lockout: Configure account lockout policies on the LDAP/Active Directory server to limit brute-force attempts (note: this does not prevent username enumeration and may cause legitimate user lockouts).

Upgrading to the patched release is the only complete remediation (GitHub Advisory, MinIO Advisory).

The advisory was published by MinIO maintainer harshavardhana on March 20, 2026, with remediation credited to developers taran-p and donatello. The vulnerability was picked up by standard vulnerability tracking services including VulDB, INCIBE-CERT, and openSUSE security announcements shortly after disclosure. The minio/minio open-source repository was subsequently archived by its owner on April 25, 2026, with users directed to the commercial MinIO AIStor product for continued support (MinIO Advisory, GitHub Advisory).