Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-33322

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

VectorNETWORK

PublishedMar 24, 2026, 20:16

Published Bysecurity-advisories@github.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/minio/minio(Go)0N/AN/A

References

https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh

Weakness Type

CWE-287

CVSS Metrics

Base Score

9.2

Vector String

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityCritical

Version

4.0

Attack Vector (AV)

NETWORK