SYS::ONLINE
Wasteland.
Briefs2256
Issues25
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-79787 2026-08-25

CVE-2026-79787: Alluxio S3 REST Proxy Authentication Bypass Lets Anyone Impersonate Any User

"A critical flaw in Alluxio's S3 REST proxy (versions through 2.9.5) skips AWS Signature Version 4 verification by default, letting unauthenticated network attackers impersonate arbitrary users and read, write, or delete…"

A critical flaw in Alluxio's S3 REST proxy (versions through 2.9.5) skips AWS Signature Version 4 verification by default, letting unauthenticated network attackers impersonate arbitrary users and read, write, or delete data at will.

What Is It

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration. Rather than validating the cryptographic signature attached to an S3 request, the proxy simply extracts the username from the Authorization header, signed or not, and trusts it. That makes identity spoofing trivial: an attacker crafts a request with any username they like and the proxy treats them as that principal.

The issue is tracked as CWE-287 (Improper Authentication) and carries a CVSS v3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (Critical) is also assigned. The CVE was published on 2026-08-25 by VulnCheck.

Why It Matters

No credentials, no user interaction, no unusual preconditions; just network reach to the proxy. Attackers can impersonate any user, including service accounts, which typically hold the broadest permissions in a data platform deployment. That yields full read, write, and delete access to arbitrary data behind the proxy: total loss of confidentiality, integrity, and availability.

CISA's SSVC assessment marks exploitation as proof-of-concept available, automatable: yes, and technical impact total. Automatable exploitation against an unauthenticated network service is the profile that gets scanned and hit at scale.

CVE-2026-79787 does not appear in the CISA Known Exploited Vulnerabilities catalog. There is no confirmation of in-the-wild exploitation at this time.

What's Vulnerable

The vulnerable behavior is present in the default configuration, so deployments that never explicitly hardened signature verification should be assumed exposed.

Patch Status

No fixed version or vendor patch has been identified. The upstream issue is tracked at Alluxio GitHub issue #18755. No CISA-mandated remediation deadline or required action exists, as this CVE is not in the KEV catalog. Operators should restrict network exposure of the S3 REST proxy and consult the VulnCheck advisory and upstream issue for mitigation guidance.

Sources