CVE-2026-33322 — MinIO has JWT Algorithm Confusion in...
CRITICAL
MinIO has JWT Algorithm Confusion in OIDC Authentication
Published March 19, 2026Updated October 8, 2026Source: osv
Summary
### Impact
_What kind of vulnerability is it? Who is impacted?_
A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC `ClientSecret` to forge arbitrary identity tokens and obtain S3 credentials with any policy, including `consoleAdmin`.
An attacker with knowledge of the OIDC `ClientSecret` can:
- Impersonate any user identity
- Obtain S3 credentials with any IAM policy, including `consoleAdmin`
- Access, modify, or delete any data in the MinIO deployment
The attack is deterministic (100% success rate, no race conditions).
#### Attack Prerequisites
The attacker must know the OIDC `ClientSecret`. While this is a shared credential (not a private key), it is more accessible than commonly assumed:
- CVE-2023-28432 previously leaked environment variables including `MINIO_IDENTITY_OPENID_CLIENT_SECRET`
- Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files
- In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities
#### Affected Versions
All MinIO releases from `RELEASE.2022-11-08T05-27-07Z` through the final release of the `minio/minio` open-source project.
### Patches
**Fixed in:** MinIO AIStor `RELEASE.2026-03-17T21-25-16Z`
## Downloads
### Binary Downloads
| Platform | Architecture | Download |
| -------- | ------------ | --------------------------------------------------------------------------- |
| Linux | amd64 | [minio](https://dl.min.io/aistor/minio/release/linux-amd64/minio) |
| Linux | arm64 | [minio](https://dl.min.io/aistor/minio/release/linux-arm64/minio) |
| macOS | arm64 | [minio](https://dl.min.io/aistor/minio/release/darwin-arm64/minio) |
| macOS | amd64 | [minio](https://dl.min.io/aistor/minio/release/darwin-amd64/minio) |
| Windows | amd64 | [minio.exe](https://dl.min.io/aistor/minio/release/windows-amd64/minio.exe) |
### FIPS Binaries
| Platform | Architecture | Download |
| -------- | ------------ | --------------------------------------------------------------------------- |
| Linux | amd64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-amd64/minio.fips) |
| Linux | arm64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-arm64/minio.fips) |
### Package Downloads
| Format | Architecture | Download |
| ------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| DEB | amd64 | [minio_20260317212516.0.0_amd64.deb](https://dl.min.io/aistor/minio/release/linux-amd64/minio_20260317212516.0.0_amd64.deb) |
| DEB | arm64 | [minio_20260317212516.0.0_arm64.deb](https://dl.min.io/aistor/minio/release/linux-arm64/minio_20260317212516.0.0_arm64.deb) |
| RPM | amd64 | [minio-20260317212516.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/release/linux-amd64/minio-20260317212516.0.0-1.x86_64.rpm) |
| RPM | arm64 | [minio-20260317212516.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/release/linux-arm64/minio-20260317212516.0.0-1.aarch64.rpm) |
### Container Images
```bash
# Standard
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
# FIPS
docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
```
### Homebrew (macOS)
```bash
brew install minio/aistor/minio
```
### Workarounds
- [Users of the open-source `minio/minio` project should upgrade to MinIO AIStor `RELEASE.2026-03-17T21-25-16Z` or later.](https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition/)
- As a workaround, ensure that the OIDC `ClientSecret` is treated as a highly sensitive credential and is not exposed to untrusted parties.
Advisory Timeline
- First published March 19, 2026 (207 days ago).
- Last revised October 8, 2026 — 203 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: go (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| github.com/minio/minio | go | All versions | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.3 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
Frequently Asked Questions
- What is CVE-2026-33322?
- MinIO has JWT Algorithm Confusion in OIDC Authentication This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.3/10).
- How do I check if my project is affected by CVE-2026-33322?
- CVE-2026-33322 affects github.com/minio/minio. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33322 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.3
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-5cx5-wh4m-82fh
GO-2026-4779
Related CVEs
- CVE-2026-33419CRITICAL
MinIO LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-107806CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- CVE-2026-68582CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies