CVE-2026-84366: Scrapy S3DownloadHandler cleartext transmission of AWS credentials

CVE-2026-84366 · Severity: high · CVSS 7.4 · Published 2026-09-01

Scrapy is a popular Python web scraping framework used to download and process content from the internet. Its S3DownloadHandler component, which facilitates downloading objects from Amazon S3 storage, has a critical flaw: it transmits AWS authentication credentials and S3 objects over unencrypted HTTP by default instead of HTTPS. An attacker on the same network (such as on public Wi-Fi, a compromised router, or via ISP observation) can eavesdrop on this traffic to steal AWS credentials and access sensitive data stored in S3, or manipulate responses to poison scraped data.

Technologies: scrapy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84366 being exploited in the wild.
How severe is CVE-2026-84366?
High severity, with a CVSS score of 7.4, published 1 September 2026.
Which products and versions are affected?
scrapy (PyPI) < 2.17.0, ECOSYSTEM:introduced=0,fixed=2.17, ECOSYSTEM:introduced=0,fixed=2.17.0.
Is there a fix for CVE-2026-84366?
Yes. scrapy (PyPI): upgrade to 2.17, 2.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84366 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84366?
Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • scrapy (PyPI): upgrade to 2.17, 2.17.0 or later
    pip install "scrapy>=2.17.0"

Technical details

The vulnerability stems from insecure default configuration in scrapy/core/downloader/handlers/s3.py. The code converts s3:// scheme requests to HTTP instead of HTTPS unless request.meta["is_secure"] is explicitly set. After rewriting the URL, the handler signs the request with AWS credentials (via add_auth) and sends it over plaintext HTTP. This violates CWE-319 (Cleartext Transmission of Sensitive Information). The attack vector is network-based; any attacker positioned on the network path between Scrapy and AWS S3 can passively eavesdrop to read bucket paths, AWS Authorization headers, temporary security tokens, and S3 object contents. Active MITM attackers can modify response bodies, status codes, and headers, leading to data poisoning and cache poisoning. Exploitation requires only that a user runs Scrapy with S3 requests and AWS credentials configured—no privileges or user interaction needed. The vulnerability affects Scrapy versions prior to 2.17.0, which patches the issue.

Affected products

  • Scrapy Project Scrapy < 2.17.0

Identifiers

  • CVE-2026-84366
  • GHSA-76g3-c3x4-crvx
  • PYSEC-2026-3918

Timeline

  • 2026-07-07: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-09-02: patched: Patched in Scrapy 2.17.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.