CVE-2026-79787: Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-09-24
Weakness: CWE-287

Description

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

Affected products

alluxio: through 2.9.5

References

https://github.com/Alluxio/alluxio
https://github.com/Alluxio/alluxio/blob/v2.9.5/core/server/proxy/src/main/java/alluxio/proxy/s3/S3RestUtils.java
https://github.com/Alluxio/alluxio/issues/18755
https://www.vulncheck.com/advisories/alluxio-through-2.9.5-s3-rest-proxy-authentication-bypass-via-unverified-request-signature
https://github.com/Alluxio/alluxio/issues/18755

Get alerted when CVE-2026-79787 or the next vulnerability affects your stack