https://silo.pgsty.com/tags/sts/Recent content in STS on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800https://silo.pgsty.com/blog/security/cve-2026-33419/Wed, 15 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-33419/<p><strong>Status:</strong> Released, followed by two rounds of corrections<br> <strong>First containing release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z">RELEASE.2026-04-17T00-00-00Z</a><br> <strong>Complete correction:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-06-18T00-00-00Z">RELEASE.2026-06-18T00-00-00Z</a><br> <strong>GitHub issue:</strong> <a href="https://github.com/pgsty/minio/issues/23">pgsty/minio#23</a></p> <p>The core vulnerability was straightforward: LDAP STS returned different results for “user does not exist” and “password is wrong,” creating a username oracle. The first fix unified the external authentication failure and added limits by source IP and username. Continued review then showed that success refunds, spoofable source headers, reservation accounting, and the shared username bucket could turn the security control itself into a new attack surface.</p>