EUVD-2026-65699
GHSA-53ch-3jwm-f8ch
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated bypass in default config with full read/write/delete over data yields PR:N, AC:L, and high C/I/A; scope unchanged as impact stays within the proxy's data plane.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.
AnalysisAI
Identity spoofing and authentication bypass in Alluxio's S3 REST proxy (versions through 2.9.5) lets remote unauthenticated attackers impersonate any user because the proxy does not verify AWS Signature Version 4 signatures in its default configuration. By reading the username directly from an unsigned Authorization header, an attacker can assume the identity of arbitrary users and service accounts to read, write, and delete data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Alluxio S3 REST proxy component must be deployed and network-reachable, and it must be running in its default configuration where SigV4 signature verification is not enforced - which the advisory states is the default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Alluxio S3 REST proxy over the network sends a normal S3 request with a hand-crafted Authorization header naming a privileged service account, omitting or faking the SigV4 signature. Because the proxy never verifies the signature in its default configuration, it treats the request as that user and grants full read/write/delete access to their data. … |
| Remediation | No vendor-released patch version is identified in the available data (the advisory describes Alluxio 'through 2.9.5' as affected and the referenced GitHub issue #18755 tracks the report, but no fixed release is confirmed here), so treat fixed-version claims cautiously and confirm with Alluxio before relying on an upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your environment to identify all Alluxio deployments running version 2.9.5 or earlier with S3 REST proxy enabled, determine network exposure of the proxy (whether accessible from untrusted networks), and disable the proxy if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username
In Alluxio before 2.7.3, the logserver does not validate the input stream. Rated critical severity (CVSS 9.8), this vuln
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today