Brute-Force Vulnerability in MinIO's STS Endpoint

CVE-2026-33419

What is CVE-2026-33419?

MinIO AIStor, a high-performance object storage system, has a security flaw in its Security Token Service (STS) within the AssumeRoleWithLDAPIdentity endpoint. This vulnerability stems from distinguishable error messages that facilitate username enumeration, coupled with a lack of rate limiting on authentication attempts. As a result, unauthorized attackers can exploit these weaknesses to identify valid LDAP usernames and conduct endless password guessing attempts to gain AWS-style STS credentials. This could lead to unauthorized access to the victim's S3 buckets and data. MinIO has addressed this issue in updates post RELEASE.2026-03-17T21-25-16Z.

References