CVE-2026-33419
Last modified
CVE-2026-33419 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Minio | Minio | < 2026-03-17t21-25-16z |
References
- https://github.com/minio/minio/security/advisories/GHSA-jv87-32hw-hh99Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33419?
How severe is CVE-2026-33419?
How do I fix CVE-2026-33419?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33413etcd is a distributed key-value store for the data of a dist…8.8
- CVE-2026-33414Podman is a tool for managing OCI containers and pods. Versi…7.8
- CVE-2026-33415Discourse is an open-source discussion platform. From versio…2.7
- CVE-2026-33416LIBPNG is a reference library for use in applications that r…7.5
- CVE-2026-33417Wallos is an open-source, self-hostable personal subscriptio…7.1
- CVE-2026-33418DiceBear is an avatar library for designers and developers. …7.5
- CVE-2026-3342An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
- CVE-2026-33420Vaultwarden is a Bitwarden-compatible server written in Rust…5.3
- CVE-2026-33421Parse Server is an open source backend that can be deployed …6.5
- CVE-2026-33422Discourse is an open-source discussion platform. Prior to ve…4.3
- CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
- CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
Are you affected by CVE-2026-33419?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST