CVE-2026-33322
Published: 24 March 2026
Summary
CVE-2026-33322 is a critical-severity Improper Authentication (CWE-287) vulnerability in Minio Minio. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-13 (Identity Providers and Authorization Servers) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33322 is a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication mechanism. MinIO, a high-performance object storage system, is affected in releases from RELEASE.2022-11-08T05-27-07Z up to but not including RELEASE.2026-03-17T21-25-16Z. The flaw, tracked under CWE-287, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts across confidentiality, integrity, and availability.
An attacker with knowledge of the OIDC ClientSecret can exploit this vulnerability remotely without privileges. By forging arbitrary identity tokens, the attacker can obtain S3 credentials bound to any policy, including consoleAdmin, enabling full control over the MinIO deployment such as data access, modification, deletion, and administrative functions.
The vulnerability has been addressed in MinIO RELEASE.2026-03-17T21-25-16Z. Security practitioners should upgrade to this or later releases for mitigation. Additional details are available in the official advisory at https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20095
Vulnerability details
MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with…
more
any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
JWT algorithm confusion enables remote auth bypass in public-facing MinIO service, allowing forged OIDC tokens and admin S3 credentials (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the JWT algorithm confusion by requiring timely identification, reporting, and correction of the vulnerability through patching to RELEASE.2026-03-17T21-25-16Z or later.
Ensures identity providers and authorization servers, including MinIO's OIDC implementation, meet requirements for secure token issuance and validation to prevent forgery via algorithm confusion.
Protects the OIDC ClientSecret from unauthorized disclosure and manages its lifecycle, blocking attackers from exploiting the vulnerability even if unpatched.