← CVE Radar
CVE-2026-79787Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.
9.3 CRITICALEPSS 0.45%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8 | CRITICAL | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-79787
- Status
- Deferred
- Assigner (CNA)
- VulnCheck
- Published
- Aug 25, 2026
- Last modified
- 2026-09-24 20:43 UTC
- Weaknesses
- CWE-287 · Improper Authentication
Affected Products
As published by the CNA in the CVE record.
Alluxioalluxio1 version range
- through 2.9.5
References
- github.com https://github.com/Alluxio/alluxio
- github.com https://github.com/Alluxio/alluxio/blob/v2.9.5/core/server/proxy/src/main/java/alluxio/proxy/s3/S3RestUtils.java
- github.com https://github.com/Alluxio/alluxio/issues/18755
- vulncheck.com https://www.vulncheck.com/advisories/alluxio-through-2.9.5-s3-rest-proxy-authentication-bypass-via-unverified-request-signature