CVE-2026-79787

CriticalCVSS 9.8/10Last modified Sep 24, 2026

Description

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Alluxio	alluxio	<= 2.9.5

References

Timeline

Published: Aug 25, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-797887.1In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`CVE-2026-79794.3Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a craf CVE-2026-797925.6A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anythin CVE-2026-797934.3A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-797949.1A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker CVE-2026-797969.8Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated r CVE-2026-797978.8An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where applica CVE-2026-797989.9SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated r CVE-2026-797998.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct CVE-2026-79808.8Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-798008.8An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation coul CVE-2026-798019.8A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauth