Alluxio

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Alluxio records in CISA KEV

No Alluxio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Alluxio 3 records HIGH

Records

4 records

TI-2023-20162 CVE-2023-38889 · GHSA-xrrh-h86w-pwfj

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a…

HIGH 82

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01077 Published 2023-08-15 No fix listed CWE-94

TI-2026-55264 CVE-2026-79787 · GHSA-53ch-3jwm-f8ch

Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

HIGH 81

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00455 Published 2026-08-25 No fix listed CWE-287

TI-2020-14063 CVE-2020-21485 · GHSA-298m-hvgh-x9cw

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00514 Published 2023-06-20 No fix listed CWE-79

TI-2022-07851 CVE-2022-23848 · GHSA-j3ch-vjph-8q6v

In Alluxio before 2.7.3, the logserver does not validate the input stream.

MEDIUM 44

In Alluxio before 2.7.3, the logserver does not validate the input stream.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01211 Published 2022-02-20 Fixed in 2.7.3

Open these records in search →

Critical	3
High	0
Medium	1
Low	0
No CVSS	0