Alluxio’s S3 REST proxy does not verify AWS Signature Version 4 signatures in its default configuration, allowing an unauthenticated attacker to forge user identities. By sending requests with unsigned Authorization headers, an attacker can read the embedded username, impersonate any user—including privileged service accounts—and perform arbitrary read, write, or delete operations on data stored behind the proxy. This flaw is a classic authentication bypass (CWE‑287) that can compromise confidentiality, integrity, and availability of data.

Alluxio builds up to and including version 2.9.5 that expose the S3 REST proxy remain vulnerable. The vulnerability applies to all Alluxio deployments that use the default S3 REST proxy configuration and do not enforce signature verification.

The CVSS score of 9.3 signifies critical severity. Although the EPSS score is not available, the exploit is straightforward for anyone with network reach to the S3 REST proxy endpoint, which is typically exposed over HTTP/HTTPS. The lack of a KEV listing does not diminish the risk; once an attacker can reach the proxy, they can freely impersonate users and manipulate data. The vulnerability therefore poses a high risk of data compromise in any environment where the proxy is reachable from untrusted networks.