CRITICALCVSS 9.8Vulnerability

CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

Properties

severity
CRITICAL
cvss_severity
CRITICAL
cvss_score
9.8
retrieved_at
2026-09-25T15:10:03+00:00
score
9.8
last_source
NVD
cve_id
CVE-2026-79787
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
signal_observed_at
2026-09-25T15:10:03+00:00
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-25T19:16:54.907
last_modified
2026-09-24T20:43:32.537

Related Entities (2)

DESCRIBED_BY (1)

→[Source]NVD

HAS_WEAKNESS (1)

→[Weakness]Improper Authentication

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-79787 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal