Docker CVE-2026-33419

MinIO AIStor with LDAP authentication enabled and STS AssumeRoleWithLDAPIdentity endpoint exposed. Unauthenticated remote attacker performs username enumeration via distinguishable error responses, then unlimited password brute-forcing against valid LDAP accounts due to absent rate limiting.

This vulnerability presents significant real-world risk for organizations using MinIO with LDAP authentication. The attack requires no prior authentication or privileges (CVSS Attack Vector: Network, Privileges Required: None), making it accessible to any network-based attacker. Attack complexity is low as the vulnerability can be exploited with standard HTTP requests and publicly documented API endpoints. The combination of username enumeration and unlimited authentication attempts creates a straightforward attack path: automated tools can first harvest valid usernames in minutes, then launch dictionary or credential-stuffing attacks against confirmed accounts. While no CVSS score is currently published and EPSS/KEV status is unavailable, the technical impact is high—successful exploitation grants full access to S3 resources with the victim's privileges. Organizations using containerized deployments (Docker, Podman) are particularly exposed as MinIO is commonly deployed in cloud-native environments with network accessibility. The availability of a specific patch (RELEASE.2026-03-17T21-25-16Z) indicates vendor recognition of severity, and the detailed advisory with multiple workarounds suggests active concern about exploitation potential.

An external attacker scans for MinIO deployments with LDAP authentication enabled and sends crafted requests to the AssumeRoleWithLDAPIdentity STS endpoint with various username values, observing response differences to enumerate valid LDAP accounts within the organization (e.g., admin, svc-backup, john.doe). Once valid usernames are confirmed, the attacker launches an automated password brute-force attack using common passwords, leaked credential databases, or dictionary lists, with no rate limiting to slow the attack. Upon successfully guessing credentials for a privileged account, the attacker obtains temporary AWS STS credentials (AccessKeyId, SecretAccessKey, SessionToken) and uses standard S3 API tools to exfiltrate sensitive data from buckets, delete objects, or establish persistence by creating additional access policies.