What is CVE-2026-33419?

CVE-2026-33419 is a high-severity vulnerability in Minio, classified under Observable Response Discrepancy. CVSS score: 7.5/10. Published 2026-03-24.

How severe is CVE-2026-33419?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Minio

CVE-2026-33419

MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

EPSS: 0.004 (32.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Minio — versions < RELEASE.2026-03-17T21-25-16Z

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-33419?: CVE-2026-33419 is a high-severity vulnerability in Minio, classified under Observable Response Discrepancy. CVSS score: 7.5/10. Published 2026-03-24.
How severe is CVE-2026-33419?: High severity. CVSS v3 base score is 7.5 out of 10.