CVE-2026-33419: LDAP Brute-Force in MinIO Object Storage

The impact of CVE-2026-33419 is severe. Successful exploitation allows an attacker to enumerate valid LDAP users and then brute-force their credentials. This can lead to unauthorized access to MinIO buckets, potentially exposing sensitive data stored within. The lack of a rate limit exacerbates the risk, enabling rapid attempts to guess passwords. Compromise of MinIO could also facilitate lateral movement within the network if the storage is integrated with other systems, as attackers could leverage stolen credentials to access other resources. The blast radius extends to any data stored in MinIO, including backups, archives, and application data.

1. Reserved2026-03-19
2. Published2026-03-20
3. Modified2026-03-27
4. EPSS updated2026-04-01

The primary mitigation for CVE-2026-33419 is to immediately upgrade MinIO to version RELEASE.2026-03-17T21-25-16Z or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These include restricting LDAP access to trusted networks using firewall rules, and enabling multi-factor authentication (MFA) for LDAP users. Monitor LDAP logs for suspicious login attempts and implement rate limiting at the LDAP server level if possible. After upgrading, verify the fix by attempting a brute-force LDAP login from an unauthorized source; successful authentication should be prevented.