CVE-2026-33419: MinIO AIStor Auth Bypass Vulnerability

CVE-2026-33419 Overview

MinIO is a high-performance object storage system that provides S3-compatible storage functionality. A critical vulnerability exists in MinIO AIStor's Security Token Service (STS) AssumeRoleWithLDAPIdentity endpoint that enables LDAP credential brute-forcing attacks. This vulnerability results from two combined weaknesses: distinguishable error responses that allow username enumeration, and the absence of rate limiting on authentication attempts. An unauthenticated network attacker can exploit these flaws to enumerate valid LDAP usernames and subsequently perform unlimited password guessing attacks to obtain temporary AWS-style STS credentials, ultimately gaining unauthorized access to the victim's S3 buckets and objects.

Critical Impact

Unauthenticated attackers can enumerate LDAP usernames and brute-force credentials to gain full access to S3 buckets and sensitive object data through the STS service.

Affected Products

• MinIO AIStor versions prior to RELEASE.2026-03-17T21-25-16Z
• MinIO deployments using LDAP authentication with STS
• Systems exposing the AssumeRoleWithLDAPIdentity endpoint

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33419 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33419

Vulnerability Analysis

This vulnerability is classified under CWE-204 (Observable Response Discrepancy), which describes situations where a product returns different responses based on security-relevant conditions, enabling attackers to infer system state. In the context of MinIO's STS implementation, the AssumeRoleWithLDAPIdentity endpoint exhibits two critical security weaknesses that, when combined, create a significant attack surface for credential compromise.

The first weakness involves distinguishable error responses during the authentication process. When an attacker attempts to authenticate with an invalid username versus an invalid password for a valid username, the endpoint returns different error messages or response characteristics. This allows attackers to systematically enumerate valid LDAP usernames by analyzing response differences.

The second weakness is the complete absence of rate limiting on authentication attempts against the STS endpoint. Without throttling mechanisms, attackers can perform high-volume automated password guessing attacks once valid usernames have been identified through the enumeration phase.

Root Cause

The root cause stems from inadequate security controls in the STS authentication flow. The LDAP authentication implementation fails to normalize error responses, creating an information disclosure channel that reveals whether a username exists in the directory. Additionally, the endpoint lacks defensive mechanisms such as account lockout policies, progressive delays, or request rate limiting that would typically protect against brute-force attacks. This combination of verbose error handling and missing anti-automation controls creates an exploitable authentication bypass scenario.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker with network access to the MinIO STS endpoint can execute the following attack sequence:

Phase 1 - Username Enumeration: The attacker sends authentication requests with candidate usernames to the AssumeRoleWithLDAPIdentity endpoint. By analyzing the differences in error responses between valid and invalid usernames, the attacker builds a list of confirmed LDAP users.

Phase 2 - Credential Brute-Force: Using the enumerated usernames, the attacker performs automated password spraying or dictionary attacks against the STS endpoint. Without rate limiting, thousands of password attempts can be made rapidly against each identified user account.

Phase 3 - Credential Access: Upon successful authentication, the attacker receives temporary AWS-style STS credentials that grant access to S3 buckets and objects according to the compromised user's permissions.

The attack requires only network connectivity to the MinIO service and can be executed using standard HTTP tools or custom scripts targeting the STS API endpoint.

Detection Methods for CVE-2026-33419

Indicators of Compromise

• High volume of failed authentication attempts against the AssumeRoleWithLDAPIdentity endpoint from single IP addresses or address ranges
• Sequential or patterned username enumeration attempts visible in authentication logs
• Successful STS credential issuance following extended periods of authentication failures
• Unusual geographic origin or timing of STS authentication requests

Detection Strategies

• Implement authentication logging with detailed capture of source IP, username attempted, and response codes for the STS endpoint
• Configure SIEM rules to alert on threshold-based authentication failure patterns indicating enumeration or brute-force activity
• Monitor for credential usage anomalies following successful authentication from previously unknown sources
• Deploy network intrusion detection signatures for high-frequency requests to MinIO STS endpoints

Monitoring Recommendations

• Enable comprehensive audit logging on MinIO servers covering all STS API operations
• Establish baseline metrics for normal authentication volume and flag deviations exceeding defined thresholds
• Configure alerting for successful authentications that follow multiple failures from the same source
• Review authentication logs regularly for signs of systematic username testing patterns

How to Mitigate CVE-2026-33419

Immediate Actions Required

• Upgrade MinIO to version RELEASE.2026-03-17T21-25-16Z or later immediately
• Review authentication logs for evidence of exploitation attempts prior to patching
• Implement network-level rate limiting on the STS endpoint if immediate patching is not possible
• Rotate LDAP credentials for accounts that may have been compromised

Patch Information

MinIO has released a security patch in version RELEASE.2026-03-17T21-25-16Z that addresses this vulnerability. The patch normalizes error responses to prevent username enumeration and implements rate limiting controls on the AssumeRoleWithLDAPIdentity endpoint. Organizations should upgrade to this version or later as the primary remediation action. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to the MinIO STS endpoint using firewall rules to limit exposure to trusted networks only
• Implement a reverse proxy or web application firewall with rate limiting capabilities in front of the MinIO service
• Enable account lockout policies at the LDAP directory level to limit the effectiveness of brute-force attempts
• Consider disabling LDAP-based STS authentication temporarily if it is not business-critical until patching can be completed

# Configuration example - Restrict MinIO STS endpoint access via iptables
# Allow only internal network access to MinIO STS port
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP

# Example nginx rate limiting configuration for MinIO proxy
# Add to nginx configuration to throttle STS endpoint requests
limit_req_zone $binary_remote_addr zone=sts_limit:10m rate=5r/s;
location /minio/sts {
    limit_req zone=sts_limit burst=10 nodelay;
    proxy_pass http://minio-backend;
}