MinIO LDAP Login Brute-Force via User Enumeration und fehlender Ratenbegrenzung in github.com/minio/minio

The impact of CVE-2026-33419 is severe. Successful exploitation allows an attacker to gain unauthorized access to MinIO buckets and data stored within them. By systematically attempting LDAP credentials, an attacker can bypass authentication and compromise the entire storage system. This could lead to data breaches, data manipulation, and potentially complete system takeover. The lack of a rate limit exacerbates the risk, making it easier for attackers to automate the brute-force process and quickly identify valid credentials. The potential for widespread data exposure makes this a high-priority vulnerability to address.

Organizations heavily reliant on MinIO for data storage, particularly those using LDAP authentication for user access, are at significant risk. Environments with weak LDAP password policies or those lacking network segmentation are especially vulnerable. Shared hosting environments utilizing MinIO also pose a heightened risk due to potential cross-tenant exposure.

• linux / server:

journalctl -u minio -g ldap | grep "invalid credentials"

• generic web:

curl -I https://<minio_endpoint>/ | grep 'Server: MinIO' #Verify MinIO version

• linux / server:

ps aux | grep minio | grep ldap #Check for LDAP connections

1. 2026-03-20Disclosure

   disclosure

2. 2026-03-17Patch

   patch

1. Reserviert2026-03-19
2. Veröffentlicht2026-03-20
3. Geändert2026-03-27
4. EPSS aktualisiert2026-04-01

The primary mitigation for CVE-2026-33419 is to immediately upgrade MinIO to version RELEASE.2026-03-17T21-25-16Z or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict LDAP access to trusted networks using firewall rules. Implement multi-factor authentication (MFA) for LDAP users to add an additional layer of security. Monitor LDAP logs for suspicious activity, such as a high volume of failed login attempts. Consider implementing a WAF (Web Application Firewall) with rules to detect and block brute-force attempts. After upgrading, confirm the fix by attempting a brute-force LDAP login and verifying that authentication fails with appropriate rate limiting.