CVE-2026-79787: Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Alluxio through version 2.9.5 with the S3 REST proxy in its default configuration are exposed. The issue affects the proxy’s handling of AWS Signature Version 4 authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the S3 REST proxy. No valid credentials, prior privileges, or user interaction are required; the attacker can use an unsigned Authorization header containing the identity to impersonate.
What access can an attacker obtain?
An attacker can impersonate any user identity, including service accounts. This can permit reading, writing, and deleting arbitrary data accessible through the impersonated identity.
How can defenders determine whether they are affected?
Verify whether the environment runs Alluxio 2.9.5 or an earlier version and exposes the S3 REST proxy using its default configuration. Review proxy requests and logs for unsigned Authorization headers that specify usernames, particularly identities that should not have originated the request.