---
id: CVE-2026-79787
title: >-
  Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in
  its default configuration, allowing unauthenticated attackers to spoof user
  identity
summary: >-
  Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in
  its default configuration, allowing unauthenticated attackers to spoof user
  identity. Attackers can extract usernames from unsigned Authorization headers
  and i…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
published: '2026-08-25'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79787'
references:
  - url: 'https://github.com/Alluxio/alluxio'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Alluxio/alluxio/blob/v2.9.5/core/server/proxy/src/main/java/alluxio/proxy/s3/S3RestUtils.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Alluxio/alluxio/issues/18755'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/alluxio-through-2.9.5-s3-rest-proxy-authentication-bypass-via-unverified-request-signature
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Alluxio/alluxio/issues/18755'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00641
epssPercentile: 0.48445
ingestedAt: '2026-09-24T20:51:40.227Z'
---

## Overview

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.