CVE-2026-33322

Critical

Published: 24 March 2026

Published

24 March 2026

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33322 is a critical-severity Improper Authentication (CWE-287) vulnerability in Minio Minio. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-13 (Identity Providers and Authorization Servers) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the JWT algorithm confusion by requiring timely identification, reporting, and correction of the vulnerability through patching to RELEASE.2026-03-17T21-25-16Z or later.

IA-13 Identity Providers and Authorization Servers good match

prevent

Ensures identity providers and authorization servers, including MinIO's OIDC implementation, meet requirements for secure token issuance and validation to prevent forgery via algorithm confusion.

IA-5 Authenticator Management partial match

prevent

Protects the OIDC ClientSecret from unauthorized disclosure and manages its lifecycle, blocking attackers from exploiting the vulnerability even if unpatched.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

JWT algorithm confusion enables remote auth bypass in public-facing MinIO service, allowing forged OIDC tokens and admin S3 credentials (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with…

any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.

Deeper analysisAI

CVE-2026-33322 is a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication mechanism. MinIO, a high-performance object storage system, is affected in releases from RELEASE.2022-11-08T05-27-07Z up to but not including RELEASE.2026-03-17T21-25-16Z. The flaw, tracked under CWE-287, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts across confidentiality, integrity, and availability.

An attacker with knowledge of the OIDC ClientSecret can exploit this vulnerability remotely without privileges. By forging arbitrary identity tokens, the attacker can obtain S3 credentials bound to any policy, including consoleAdmin, enabling full control over the MinIO deployment such as data access, modification, deletion, and administrative functions.

The vulnerability has been addressed in MinIO RELEASE.2026-03-17T21-25-16Z. Security practitioners should upgrade to this or later releases for mitigation. Additional details are available in the official advisory at https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh.