CVE-2026-42882: s3-proxy Authentication Bypass Vulnerability

CVE-2026-42882 Overview

CVE-2026-42882 is a critical authentication bypass vulnerability in oxyno-zeta/s3-proxy, an AWS S3 proxy written in Go. The flaw originates from inconsistent URL path interpretation between the authentication middleware and the bucket handler. The middleware evaluates resource path patterns against the percent-encoded request URI via r.URL.RequestURI(), while the bucket handler constructs S3 object keys from the decoded r.URL.Path. Unauthenticated attackers can leverage this mismatch to perform PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. The vulnerability is fixed in version 5.0.0.

Critical Impact
Unauthenticated network attackers can read, overwrite, or delete objects in protected S3 namespaces, bypassing authentication entirely.

Affected Products

oxyno-zeta/s3-proxy versions prior to 5.0.0
Deployments using glob-based resource path patterns for authentication
S3 proxy instances exposing protected namespaces over the network

Discovery Timeline

2026-05-11 - CVE-2026-42882 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42882

Vulnerability Analysis

The vulnerability is a classic path traversal and parser differential issue [CWE-22]. The authentication layer and the storage layer interpret the same request URL differently, allowing the auth check to match a permissive route while the storage handler resolves to a protected one.

Three exploitation techniques are documented in the advisory. First, * patterns match across path separators because the glob library is compiled without a / separator, enabling traversal sequences such as /open/foo/drafts/../restricted/ to reach protected routes. Second, percent-encoded slashes (%2F) collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer. Third, dot-dot segments (../) placed under ** prefix patterns let the raw path match an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler executes.

Root Cause

The root cause is the mismatch between r.URL.RequestURI() used for authorization decisions and r.URL.Path used for S3 key construction. The glob pattern compilation in pkg/s3-proxy/authx/authentication/main.go was invoked without a path separator argument, allowing wildcards to match across / boundaries.

Attack Vector

An unauthenticated attacker with network access to the proxy sends a crafted HTTP request containing percent-encoded slashes or dot-segment traversals. The authentication middleware matches the encoded form against a public route pattern, while the bucket handler decodes the path and operates on a protected S3 namespace.

// Security patch: pkg/s3-proxy/authx/authentication/main.go
// Fix: add '/' separator to glob pattern compilation
			continue
 		}
 		// Compile a glob pattern for uri matching
-		g, err := glob.Compile(res.Path)
+		g, err := glob.Compile(res.Path, '/')
 		// Check if error exists
 		if err != nil {
 			return nil, errors.WithStack(err)

Source: GitHub commit 1320e4a

// Security patch: pkg/s3-proxy/server/middlewares/reject-traversal.go
// New middleware rejects dot-segment traversals before routing and auth
func RejectTraversal(cfgManager config.Manager) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			hasDot, err := isPathTraversalAttempt(r.URL.EscapedPath())
			if err != nil {
				responsehandler.GeneralBadRequestError(r, w, cfgManager, errors.WithStack(err))
				return
			}
			// ...
		})
	}
}

Source: GitHub commit af5ff57

Detection Methods for CVE-2026-42882

Indicators of Compromise

HTTP requests containing %2F (encoded slash) sequences targeting s3-proxy endpoints
Request URIs containing ../ or %2E%2E%2F dot-segment traversals against ** or * route patterns
Unexpected PUT, GET, or DELETE operations against protected S3 prefixes originating from unauthenticated sessions
Access log entries where the matched auth route differs structurally from the resolved object key

Detection Strategies

Compare authentication middleware route matches against the final decoded r.URL.Path to identify parser differential exploitation
Inspect proxy access logs for percent-encoded slashes or dot-segments preceding protected namespace identifiers
Alert on S3 object-level operations targeting protected prefixes without a corresponding authenticated principal in audit logs

Monitoring Recommendations

Enable verbose logging for both the authentication middleware and bucket handler to capture pre-decode and post-decode paths
Monitor S3 CloudTrail data events for unexpected writes or deletes against protected namespaces fronted by s3-proxy
Track request rate anomalies on ** and * glob-matched routes from previously unseen source addresses

How to Mitigate CVE-2026-42882

Immediate Actions Required

Upgrade oxyno-zeta/s3-proxy to version 5.0.0 or later without delay
Audit S3 bucket contents and access logs for unauthorized PUT, GET, or DELETE operations against protected prefixes
Rotate any credentials or sensitive material that may have been exposed in protected S3 namespaces
Restrict network access to the s3-proxy administrative and bucket endpoints to trusted networks until patched

Patch Information

The maintainer released version 5.0.0 containing two fixes. Commit 1320e4a adds the / separator to glob pattern compilation so wildcards no longer cross path boundaries. Commit af5ff57 introduces a RejectTraversal middleware that decodes and validates the escaped path before routing and authentication run, returning 400 Bad Request on traversal attempts. See the GitHub Security Advisory GHSA-rfgq-wgg8-662p for full details.

Workarounds

Place a reverse proxy or web application firewall in front of s3-proxy to reject requests containing %2F, %2E%2E, or ../ sequences
Replace * and ** glob patterns in resource path configuration with explicit literal path prefixes where feasible
Disable public route patterns that overlap with protected namespaces until the upgrade is complete

bash

# Example: upgrade s3-proxy container image to the fixed release
docker pull oxynozeta/s3-proxy:5.0.0
docker stop s3-proxy && docker rm s3-proxy
docker run -d --name s3-proxy \
  -p 8080:8080 \
  -v /etc/s3-proxy/config.yaml:/proxy/conf/config.yaml \
  oxynozeta/s3-proxy:5.0.0