MinIO up to 0.0.0-20260212201848-7aac2a2c5b7c Security Token Service AccessKeyId/SecretAccessKey/SessionToken information exposure

Summaryinfo

A vulnerability labeled as problematic has been found in MinIO up to 0.0.0-20260212201848-7aac2a2c5b7c. Impacted is an unknown function of the component Security Token Service. The manipulation of the argument AccessKeyId/SecretAccessKey/SessionToken results in information exposure. This vulnerability was named CVE-2026-33419. The attack may be performed from remote. In addition, an exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in MinIO up to 0.0.0-20260212201848-7aac2a2c5b7c. It has been classified as problematic. Affected is an unknown part of the component Security Token Service. The manipulation of the argument AccessKeyId/SecretAccessKey/SessionToken with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. This is going to have an impact on confidentiality. CVE summarizes:

MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-33419. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Applying a patch is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• MinIO

Version

• 0.0.0-20260212201848-7aac2a2c5b7c

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #779190: minio <=RELEASE.2025-10-15T17-29-55Z Improper Restriction of Excessive Authentication Attempts (by ZAST.AI)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion