Vulnerabilities

TI-2026-55264 CVE-2026-79787 · GHSA-53ch-3jwm-f8ch

Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

HIGH 81

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00455 Published 2026-08-25 No fix listed CWE-287

TI-2023-20162 CVE-2023-38889 · GHSA-xrrh-h86w-pwfj

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a…

HIGH 82

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01077 Published 2023-08-15 No fix listed CWE-94

TI-2020-14063 CVE-2020-21485 · GHSA-298m-hvgh-x9cw

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00514 Published 2023-06-20 No fix listed CWE-79

TI-2022-07851 CVE-2022-23848 · GHSA-j3ch-vjph-8q6v

In Alluxio before 2.7.3, the logserver does not validate the input stream.

MEDIUM 44

In Alluxio before 2.7.3, the logserver does not validate the input stream.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01211 Published 2022-02-20 Fixed in 2.7.3

Vulnerabilities

Filters

Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a…

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to…

In Alluxio before 2.7.3, the logserver does not validate the input stream.