CVE-2026-79787

CVSS 9.8 (critical) · published 2026-08-25

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

Weakness: CWE-287

Source: NVD CVE-2026-79787

References

• https://github.com/Alluxio/alluxio
• https://github.com/Alluxio/alluxio/blob/v2.9.5/core/server/proxy/src/main/java/alluxio/proxy/s3/S3RestUtils.java
• https://github.com/Alluxio/alluxio/issues/18755
• https://www.vulncheck.com/advisories/alluxio-through-2.9.5-s3-rest-proxy-authentication-bypass-via-unverified-request-signature
• https://github.com/Alluxio/alluxio/issues/18755

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.