CVE-2026-79787CWE-287

CVE-2026-79787

Critical · published August 25, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-25T23:16Z
References (5)
https://github.com/Alluxio/alluxio · [email protected]https://github.com/Alluxio/alluxio/blob/v2.9.5/core/server/proxy/src/main/java/alluxio/proxy/s3/S3RestUtils.java · [email protected]https://github.com/Alluxio/alluxio/issues/18755 · [email protected]https://www.vulncheck.com/advisories/alluxio-through-2.9.5-s3-rest-proxy-authentication-bypass-via-unverified-request-signature · [email protected]https://github.com/Alluxio/alluxio/issues/18755 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 18:23Z
    Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature
    cvelistv5