CVE-2026-33419
MinIO: LDAP login brute-force via user enumeration and missing rate limit
描述
MinIO is a high-performance object storage system. Prior to 2026.03.17, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: (1) distinguishable error responses that enable username enumeration, and (2) absence of rate limiting on authentication attempts. An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects. This issue has been patched in 2026.03.17.
如何修補 CVE-2026-33419
要修補 CVE-2026-33419,請將受影響套件升級到下列已修補版本。
- —升級至 2026.03.17 或更新版本
- —未列出修補版本
- —未列出修補版本
CVE-2026-33419 正在被利用嗎?
低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 2026.03.17
- from 0, <= 0.0.0-20260212201848-7aac2a2c5b7c
- from 0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |