CVE-2026-33322: MinIO: JWT Algorithm Confusion in OIDC Authentication
Impact What kind of vulnerability is it? Who is impacted?
A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin.
An attacker with knowledge of the OIDC ClientSecret can:
- Impersonate any user identity - Obtain S3 credentials with any IAM policy, including consoleAdmin - Access, modify, or delete any data in the MinIO deployment
The attack is deterministic (100% success rate, no race conditions).
Attack Prerequisites
The attacker must know the OIDC ClientSecret. While this is a shared credential (not a private key), it is more accessible than commonly assumed:
- CVE-2023-28432 previously leaked environment variables including MINIOIDENTITYOPENIDCLIENTSECRET - Client secrets are often present in frontend OAuth configurations, mobile app bundles, CI/CD pipelines, and shared configuration files - In many organizations, the client secret is accessible to operators and engineers who should not be able to forge arbitrary identities
Affected Versions
All MinIO releases from RELEASE.2022-11-08T05-27-07Z through the final release of the minio/minio open-source project.
Patches
Fixed in: MinIO AIStor RELEASE.2026-03-17T21-25-16Z
Downloads
Binary Downloads
| Platform | Architecture | Download | | -------- | ------------ | --------------------------------------------------------------------------- | | Linux | amd64 | minio | | Linux | arm64 | minio | | macOS | arm64 | minio | | macOS | amd64 | minio | | Windows | amd64 | minio.exe |
FIPS Binaries
| Platform | Architecture | Download | | -------- | ------------ | --------------------------------------------------------------------------- | | Linux | amd64 | minio.fips | | Linux | arm64 | minio.fips |
Package Downloads
| Format | Architecture | Download | | ------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | minio20260317212516.0.0amd64.deb | | DEB | arm64 | minio20260317212516.0.0arm64.deb | | RPM | amd64 | minio-20260317212516.0.0-1.x8664.rpm | | RPM | arm64 | minio-20260317212516.0.0-1.aarch64.rpm |
Container Images
bash Standard docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z
FIPS docker pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips podman pull quay.io/minio/aistor/minio:RELEASE.2026-03-17T21-25-16Z.fips
Homebrew (macOS)
bash brew install minio/aistor/minio
Workarounds
- Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later. - As a workaround, ensure that the OIDC ClientSecret is treated as a highly sensitive credential and is not exposed to untrusted parties.
Other sources
MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC ClientSecret to forge arbitrary identity tokens and obtain S3 credentials with any policy, including consoleAdmin. This issue has been patched in RELEASE.2026-03-17T21-25-16Z.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33322?
CVE-2026-33322 has a critical severity as it allows attackers to forge identity tokens and obtain S3 credentials.
How do I fix CVE-2026-33322?
To fix CVE-2026-33322, upgrade MinIO to a version above 0.0.0-20260212201848-7aac2a2c5b7c.
Who is impacted by CVE-2026-33322?
Any MinIO user utilizing OpenID Connect authentication with a vulnerable version is impacted by CVE-2026-33322.
What type of vulnerability is CVE-2026-33322?
CVE-2026-33322 is a JWT algorithm confusion vulnerability that affects MinIO's authentication process.
Can CVE-2026-33322 lead to data exposure?
Yes, CVE-2026-33322 could allow unauthorized access to sensitive data and S3 buckets if exploited.