CVE-2026-79787 is a critical (CVSS 9.8) authentication bypass in the Alluxio S3 REST proxy. By default it does not verify AWS Signature Version 4 signatures, so a caller can claim any user. No fixed version is confirmed. Turn on proxy authentication and restrict network access.
What's affected
- Product: Alluxio S3 REST proxy.
- Affected: through 2.9.5 per VulnCheck. The public issue says all versions, confirmed on v2.9.5 and the main branch on 2026-06-29.
- Fixed: no fixed version is confirmed in the pages I read. Check the Alluxio issue and releases.
- Weakness: CWE-287, improper authentication.
- CVSS 9.8 (critical), published 2026-08-25. Not listed in CISA KEV.
Per the issue, the signature check only runs when the property alluxio.s3.rest.authentication.enabled is true, and it defaults to false. Alluxio's default security mode, SIMPLE, trusts whichever user the client claims to be.
How to check if you're exposed
Find out whether the S3 proxy is running, and what its settings are. Look in your Alluxio site properties for the setting named above.
grep -r "alluxio.s3.rest.authentication.enabled" $ALLUXIO_HOME/conf/
If it is missing or false, the proxy is in the vulnerable default. Then check who can reach the proxy port. The issue names 39999 as the default. Check access logs for requests that claim service account names such as the Alluxio user.
What to do now
- Check the Alluxio issue and releases for a fixed version, and apply it when it exists.
- Set
alluxio.s3.rest.authentication.enabledto true and test that clients with valid credentials still work and unsigned ones are refused. - Restrict the proxy port to the application hosts that need it, and keep it off the internet.
- Do not rely on SIMPLE security mode where untrusted networks can reach Alluxio.
- Review data owned by service accounts for unexpected reads, writes or deletes.
Why it matters
The code path is plain in the public issue. When authentication is off, the proxy reads the user name from the Credential field of the Authorization header and never checks the signature. It then creates a filesystem client for that user. Anyone who can send a request can name any account.
The flaw is in the default, not a rare setting. Secure by default matters most for data layer services, which sit in front of data many teams share. Check the defaults of every proxy you run.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version?
I could not confirm one. Check the Alluxio repository and the linked issue.
Does turning on authentication fix it?
The issue shows the signature check runs when the property is true. Test your own deployment after changing it.
Sources
Last reviewed: 19 October 2026.
