Scrapy CVE-2026-84366

Exploitation requires the attacker to hold a man-in-the-middle position on the IP network path between the Scrapy process and AWS S3 service endpoints - either through ARP spoofing on a local segment, BGP route manipulation, a compromised network device, or shared infrastructure such as a cloud VPC with insufficient segmentation. On the Scrapy side, the application must be issuing s3:// scheme requests; HTTP-scheme or HTTPS-scheme requests to S3 are not affected. The default configuration of Scrapy prior to 2.17.0 is vulnerable - no special misconfigurations or feature flags are required. Deployments that have explicitly set request.meta['is_secure'] = True on all S3 requests in their spider code are not exposed, as HTTPS would have been used. Deployments operating behind a TLS-enforcing proxy that re-encrypts outbound S3 traffic before it leaves the controlled network boundary are also protected. The absence of A:N (no availability impact) means denial-of-service is not a concern; the risk is limited to credential theft and data integrity corruption.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, score 7.4) accurately characterizes this as a network-exploitable, high-impact flaw gated by significant attack complexity - specifically, a privileged network position between Scrapy workers and AWS S3 infrastructure. The dual C:H/I:H is realistic and not inflated: credential exposure enables lateral movement into broader AWS environments, while response tampering directly corrupts downstream data pipelines. EPSS data was not provided and KEV status is negative, so real-world exploitation frequency is unconfirmed, but the attack requires no special tooling beyond standard packet interception. Cloud and co-location environments where Scrapy workers communicate with S3 over shared or semi-trusted network fabrics represent a credible attack surface; even a mid-sized municipal IT team in inowroclaw running Scrapy jobs in a shared cloud tenant should treat this as urgent given that harvested AWS temporary credentials can be immediately replayed against other AWS services. The AC:H gating is the primary check on widespread passive exploitation - active MitM capability is non-trivial to achieve against well-segmented cloud networks.

An attacker with a privileged network position - such as access to a shared cloud network segment, a rogue switch or router, or a compromised VPC peering gateway - passively captures plaintext HTTP traffic between a Scrapy worker and AWS S3 and extracts the AWS Authorization header and X-Amz-Security-Token from each request, obtaining valid temporary credentials that can be immediately replayed against other AWS services. For an active attack, the same attacker injects a crafted HTTP response in place of the legitimate S3 object, inserting malicious URLs into the scraped content to redirect subsequent crawl jobs toward attacker-controlled infrastructure or poisoning exported datasets. No public exploit code has been identified, but the attack requires only standard network interception tooling such as tcpdump or arpspoof.