CVE-2026-33322 is a JWT algorithm confusion flaw in MinIO's OpenID Connect login. NVD scores it 9.8 critical. An attacker who knows the OIDC ClientSecret can forge identity tokens and obtain S3 credentials with any policy, including consoleAdmin. The fix is MinIO AIStor RELEASE.2026-03-17T21-25-16Z.
What's affected
All MinIO releases from RELEASE.2022-11-08T05-27-07Z, through the final release of the open source minio/minio project. The patched build is MinIO AIStor RELEASE.2026-03-17T21-25-16Z.
That means users of the open source project have no patched open source release to move to. The advisory tells them to upgrade to AIStor. It also says only deployments that use OpenID Connect authentication are in play.
How to check if you're exposed
- Check whether OIDC identity is configured. Look for MinIO identity OpenID settings in your environment variables or admin config.
- Check the server version:
minio --version
- Compare it with the patched release above. Anything older, including the final open source build, is affected.
What to do now
- Upgrade to MinIO AIStor RELEASE.2026-03-17T21-25-16Z or later.
- Until then, treat the OIDC ClientSecret as a highly sensitive credential, as the advisory suggests. Limit who can read it.
- Look for the secret in frontend configs, mobile bundles, CI/CD pipelines and shared files, and remove copies you do not need.
- Rotate the ClientSecret if it may have been exposed, and review recent credential issuance and admin activity.
Why it matters
The advisory describes algorithm confusion. The server accepts a token signed in a way the identity provider would not have used, so a shared secret that was never meant to prove identity ends up doing so. The record maps it to CWE-287, improper authentication.
The advisory points out that the ClientSecret is a shared credential and is often easier to reach than people assume. It notes that an earlier MinIO CVE, CVE-2023-28432, leaked environment variables that included this secret. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Use the free in-browser dependency scan to see which of your services pull in MinIO components, then walk through how exposure is decided.
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed open source minio/minio release?
Not according to the advisory. It says the flaw runs through the final release of the open source project and points users to MinIO AIStor.
Does an attacker need to be logged in?
They need the OIDC ClientSecret, not an account. That is why the secret should be handled like a password.
Sources
Last reviewed: 19 October 2026.
