Verified

osv:BIT-MINIO-2026-33419: minio (exact versions not specified)

MinIO: LDAP login brute-force via user enumeration and missing rate limit. Fixed version: 2026.03.17.

Affected technology

minio · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An unauthenticated network attacker can enumerate valid LDAP usernames and then perform unlimited password guessing to obtain temporary AWS-style STS credentials, gaining access to the victim's S3 buckets and objects.

Published 13-Oct-2026 07:27 UTC

Product: minio
KEV: no

Provenance

OSV.dev · Source record · observed 2026-10-08 08:57:13.774521+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-osv-bit-minio-2026-33419.html