CVE-2026-79787: Alluxio S3 REST Proxy Auth Bypass Flaw

CVE-2026-79787 Overview

CVE-2026-79787 is an authentication bypass vulnerability in the Alluxio S3 REST proxy. In its default configuration, the proxy fails to verify AWS Signature Version 4 (SigV4) signatures on incoming requests. Attackers can extract usernames directly from unsigned Authorization headers and impersonate arbitrary users, including privileged service accounts. Successful exploitation allows unauthenticated network attackers to read, write, and delete arbitrary data stored through the proxy. The flaw is tracked under CWE-287: Improper Authentication and affects Alluxio through version 2.9.5, per the VulnCheck Advisory.

Critical Impact
Unauthenticated attackers can impersonate any user, including service accounts, to read, modify, or destroy data exposed through the Alluxio S3 REST proxy.

Affected Products

Alluxio through version 2.9.5
Alluxio S3 REST proxy component (alluxio.proxy.s3)
Deployments using the default proxy authentication configuration

Discovery Timeline

2026-08-25 - CVE-2026-79787 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database
2026-08-27 - EPSS score published by FIRST.org

Technical Details for CVE-2026-79787

Vulnerability Analysis

The Alluxio S3 REST proxy exposes an S3-compatible API in front of the Alluxio distributed file system. AWS SigV4 requires clients to sign each request using a secret key derived from their credentials. Servers must recompute and compare the signature to authenticate the caller. The affected proxy skips this cryptographic verification step entirely in its default configuration. Instead, it parses the Authorization header and trusts the Credential=<username>/... field as the authenticated identity. Any client can therefore claim to be any user by supplying a crafted header, with no key material required.

Because the proxy sits between clients and back-end storage, the impersonated identity is used for access-control decisions inside Alluxio. Impersonating an administrative or service account grants the attacker the union of that account's privileges across the namespace.

Root Cause

The root cause is missing signature validation in the proxy's authentication path. Relevant handling lives in S3RestUtils.java, where the proxy extracts the username from the SigV4 credential scope but does not recompute the HMAC-SHA256 signature or verify the request timestamp and canonical request. The design treats the SigV4 header as an identity assertion rather than a cryptographic proof, mapping directly to [CWE-287: Improper Authentication].

Attack Vector

Exploitation requires only network reachability to the proxy port. An attacker sends a standard S3 API request (for example, GET, PUT, or DELETE on a bucket or object) and populates the Authorization header with AWS4-HMAC-SHA256 Credential=<victim-username>/... and an arbitrary Signature= value. The proxy parses the credential, assumes the identity of <victim-username>, and performs the requested operation against the underlying file system. No prior credentials, tokens, or user interaction are required. See GitHub Issue #18755 for related discussion.

No verified public exploit code is available. Refer to the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-79787

Indicators of Compromise

Requests to the Alluxio S3 proxy where the Authorization header contains a Credential= scope referencing privileged users such as root, admin, or service accounts from unfamiliar source IPs.
Repeated requests reusing identical or obviously invalid Signature= values across different callers.
Unexpected PUT, DELETE, or POST operations against Alluxio buckets originating outside normal application subnets.
Access to sensitive namespaces or objects by identities that historically only issue read operations.

Detection Strategies

Enable and centralize proxy access logs, then alert on Alluxio S3 requests where the SigV4 Credential username does not match the expected caller for the source network segment.
Baseline the set of usernames observed in Authorization headers per client IP and flag deviations, especially those referencing service accounts.
Correlate proxy request logs with downstream Alluxio master audit logs to detect operations attributed to accounts that never authenticated through an interactive workflow.

Monitoring Recommendations

Forward Alluxio proxy and master logs into a centralized analytics platform for retention and query.
Monitor for spikes in 2xx responses to unauthenticated or externally sourced S3 API traffic.
Track network flows to the proxy port and alert on connections from outside authorized application tiers.

How to Mitigate CVE-2026-79787

Immediate Actions Required

Restrict network access to the Alluxio S3 REST proxy so that only trusted application hosts can reach it, using firewalls, security groups, or service mesh policies.
Audit recent proxy and Alluxio master logs for requests referencing privileged accounts and investigate any unexpected data reads, writes, or deletions.
Rotate credentials for any service accounts that may have been impersonated through the proxy.
Disable the S3 REST proxy in environments where it is not required.

Patch Information

At the time of publication, no fixed Alluxio version is listed in the NVD entry for CVE-2026-79787. Review the Alluxio GitHub repository and the VulnCheck advisory for the latest guidance and upgrade instructions. Deployments running Alluxio 2.9.5 or earlier with the default proxy configuration should be treated as vulnerable.

Workarounds

Place the S3 proxy behind an authenticating reverse proxy or API gateway that enforces mutual TLS or verified bearer tokens before forwarding requests.
Bind the proxy to loopback or a private management interface so it is not reachable from user or internet-facing networks.
Segment the Alluxio deployment into a dedicated network zone with strict ingress controls and monitored egress.
Where feasible, disable the S3 REST proxy entirely and use native Alluxio clients with authenticated transport.