MinIO's STS AssumeRoleWithLDAPIdentity endpoint allowed attackers to brute‑force LDAP credentials because the service returned distinguishable error messages that exposed valid usernames and did not enforce any rate limiting. By enumerating legitimate LDAP accounts and then guessing passwords without restriction, an unauthenticated attacker could obtain temporary AWS‑style STS credentials that grant access to the victim’s S3 buckets and objects. This vulnerability enables non‑privileged users to gain full access to stored data, leading to potential data theft or tampering.

The flaw exists in all MinIO releases prior to RELEASE.2026-03-17T21-25-16Z. Systems running MinIO object storage with the STS AssumeRoleWithLDAPIdentity service enabled are vulnerable. The issue is specific to the MinIO product and not to other LDAP‑enabled applications.

The CVSS score of 9.1 classifies the vulnerability as critical. The EPSS score of less than 1% suggests low current exploitation likelihood, but the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the MinIO endpoint; the attack vector is inferred to be external network attacks that can reach the object storage service.