Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | Patch1 |
| 2026-03-21 | 1 | Disclosure1 |
| 2026-03-25 | 2 | Disclosure1Patch1 |
Warning: Critical #CVE-2026-33322 and #CVE-2026-33419 affect #MinIO and expose critical weaknesses in OIDC and LDAP authentication mechanisms. Attackers could forge identities or perform brute-force attacks. #Patch#Patch#Patch
Post summary
The warning alerts to critical MinIO vulnerabilities affecting OIDC and LDAP authentication, allowing attackers to forge identities or brute‑force them, and notes that patches are available.
🚨 CVE-2026-33322: MinI... JWT algorithm confusion + known OIDC ClientSecret = instant consoleAdmin escalation across 3+ years of MinIO deployments. #JWTConfusion #MinIO #S3. https://zerodaysignal.com/vulnerability/CVE-2026-33322 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-33322, highlighting JWT algorithm confusion in MinIO that can lead to console‑admin escalation via known OIDC ClientSecrets; it provides the technical details but no PoC, exploit, or patch is offered.
`MinIO` has a JWT Algorithm Confusion vulnerability (CVE-2026-33322) in OIDC authentication. This could lead to authentication bypass. Review OIDC configurations. #MinIO #AuthBypass #Cybersecurity https://www.pulsepatch.io/posts/cve-2026-33322-minio-jwt-algorithm-confusion
Post summary
MinIO’s OIDC authentication is vulnerable to JWT Algorithm Confusion, allowing authentication bypass, and the article advises reviewing OIDC configurations to mitigate the risk.
🚨🚨 MinIO CVE-2026-33322: Critical identity token forgery flaw could let attackers forge tokens and access sensitive data. Patch/upgrade ASAP. 🔗 https://vulert.com/vuln-db/CVE-2026-33322 🛡 https://t.co/s99vETkPn0
Post summary
The post announces MinIO CVE‑2026‑33322, a critical identity token forgery flaw, and urges users to patch or upgrade immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | minio | minio | - | - | - |