CVE-2026-84366

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.17.0

Description The S3DownloadHandler in scrapy/core/downloader/handlers/s3.py converts S3-scheme bucket and key requests into plaintext HTTP requests unless the is secure variable in request.meta is explicitly enabled. In such cases, the handler signs and sends the plaintext request using configured AWS credentials. A network attacker observing traffic can intercept the bucket and key path, the AWS Authorization header, the X-Amz-Security-Token when using temporary credentials, S3 object contents, and S3 response headers. Additionally, a man-in-the-middle attacker can modify the plaintext S3 response body, status code, and headers, potentially leading to scraped-data poisoning, poisoned exports, HTTP cache poisoning, or the manipulation of future crawl targets via forged redirects or attacker-controlled links.

Recommendations Update to version 2.17.0. As a temporary mitigation, explicitly enable the is secure variable within request.meta for S3-scheme requests.