CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature
Attackers can bypass authentication in Alluxio's S3 proxy to impersonate users and read, write, or delete arbitrary data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79787?
CVE-2026-79787 is a critical authentication bypass vulnerability in alluxio, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.
Weakness: CWE-287
Which versions are affected by CVE-2026-79787?
How do I fix CVE-2026-79787?
No fix has been published for CVE-2026-79787 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-79787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79787 exists.
Sources
Also known as GHSA-53ch-3jwm-f8ch.