Executive brief
Alluxio is a data orchestration platform that provides an S3-compatible REST API for accessing distributed storage. In its default configuration, the S3 proxy fails to verify AWS Signature Version 4 credentials, allowing unauthenticated attackers to forge requests as legitimate users—including privileged service accounts—to read, write, and delete arbitrary data stored in Alluxio.
Technical details
The vulnerability is a signature verification bypass in Alluxio's S3 REST proxy (S3RestUtils.java). The proxy fails to validate AWS Signature Version 4 (SigV4) signatures by default, allowing attackers to craft unsigned requests with spoofed Authorization headers. Attackers can extract usernames from authorization headers and impersonate any user, including service accounts, without valid credentials. The attack requires network access to the S3 proxy endpoint and does not require authentication or user interaction. An attacker can perform read, write, and delete operations on arbitrary data. The vulnerability affects Alluxio v2.9.5 and likely earlier versions.
Affected products
- Alluxio Alluxio v2.9.5 and earlier
Timeline
- 2026-08-25: disclosed