Docker
CVE-2026-33419
CRITICAL
GHSA-jv87-32hw-hh99
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
_What kind of vulnerability is it? Who is impacted?_
MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects.
All deployments with LDAP configured running an affected version are impacted.
There are two vulnerabilities:
- User Enumeration via Distinguishable Error Messages (CWE-204)
- Missing Rate Limiting on STS Authentication Endpoints (CWE-307)
When exploited together, an attacker can:
- Enumerate valid LDAP usernames by observing error message differences.
- Perform high-speed password brute-force attacks against confirmed valid users.
- Upon finding valid credentials, obtain temporary AWS-style STS credentials (
AccessKeyId,SecretAccessKey,SessionToken) with full access to the victim user's S3 resources.
Affected Versions
All MinIO releases through the final release of the minio/minio open-source project.
Patches
Fixed in: MinIO AIStor RELEASE.2026-03-17T21-25-16Z
Binary Downloads
| Platform | Architecture | Download |
|---|---|---|
| Linux | amd64 | minio |
| Linux | arm64 | minio |
| macOS | arm64 | minio |
| macOS | amd64 | minio |
| Windows | amd64 | minio.exe |
FIPS Binaries
| Platform | Architecture | Download |
|---|---|---|
| Linux | amd64 | minio.fips |
| Linux | arm64 | minio.fips |
Package Downloads
| Format | Architecture | Download |
|---|---|---|
| DEB | amd64 | minio_20260317212516.0.0_amd64.deb |
| DEB | arm64 | minio_20260317212516.0.0_arm64.deb |
| RPM | amd64 | minio-20260317212516.0.0-1.x86_64.rpm |
| RPM | arm64 | minio-20260317212516.0.0-1.aarch64.rpm |
Container Images
# Standard
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
# FIPS
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fipsHomebrew (macOS)
brew install minio/aistor/minioWorkarounds
If upgrading is not immediately possible:
- Network-level rate limiting: Use a reverse proxy (e.g., nginx, HAProxy) or WAF to rate-limit requests to the
/?Action=AssumeRoleWithLDAPIdentityendpoint. - Firewall restrictions: Restrict access to the STS endpoint to trusted networks/IP ranges only.
- LDAP account lockout: Configure account lockout policies on the LDAP server itself (e.g., Active Directory lockout threshold). Note: this protects against brute-force but not enumeration, and may cause denial-of-service for legitimate users.
AnalysisAI
MinIO AIStor's Security Token Service (STS) AssumeRoleWithLDAPIdentity endpoint contains two combined vulnerabilities that enable LDAP credential brute-forcing: distinguishable error messages allowing username enumeration (CWE-204) and missing rate limiting (CWE-307). All MinIO deployments through the final open-source release with LDAP authentication enabled are affected. Unauthenticated network attackers can enumerate valid LDAP usernames, perform unlimited password guessing attacks, and obtain temporary AWS-style STS credentials granting full access to victim users' S3 buckets and objects.
Technical ContextAI
MinIO AIStor is an S3-compatible object storage server (pkg:go/github.com_minio_minio) that implements AWS Security Token Service (STS) functionality for temporary credential generation. The AssumeRoleWithLDAPIdentity API endpoint authenticates users against LDAP directories and issues time-limited AccessKeyId, SecretAccessKey, and SessionToken credentials. The vulnerability stems from two CWE classes: CWE-204 (Observable Response Discrepancy) where different error messages reveal whether a username exists in LDAP, and CWE-307 (Improper Restriction of Excessive Authentication Attempts) where the absence of rate limiting allows attackers to perform high-speed brute-force attacks. When LDAP authentication is configured, the STS endpoint becomes an unauthenticated attack surface that directly queries the backend LDAP directory without implementing standard authentication defenses like account lockout, CAPTCHA, or request throttling.
RemediationAI
Users should upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later, which includes fixes for both the username enumeration and rate limiting vulnerabilities. Binaries are available for all supported platforms at https://dl.min.io/aistor/minio/release/, container images at quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z, and via Homebrew (brew install minio/aistor/minio). Open-source minio/minio users should migrate to MinIO AIStor following guidance at https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition/. If immediate patching is not feasible, implement network-level rate limiting using a reverse proxy (nginx, HAProxy) or Web Application Firewall to throttle requests to the /?Action=AssumeRoleWithLDAPIdentity endpoint. Restrict network access to the STS endpoint using firewall rules to allow only trusted IP ranges. Configure LDAP-side account lockout policies on Active Directory or other directory servers, though this protects against brute-force but not enumeration and may cause denial-of-service for legitimate users.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today