CVE-2026-79787

Name of the Vulnerable Software and Affected Versions Alluxio (affected versions not specified)

Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames from unsigned Authorization headers. Consequently, an attacker can impersonate any user, including service accounts, to perform unauthorized read, write, and delete operations on arbitrary data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.