Alluxio npm Package Vulnerability: Critical Identity Spoofing Risk
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- alluxio (npm)
- Affected versions
- >= v2.9.5, <= v2.9.5 or >= v2.9.4, <= v2.9.4 or >= v1.7.0-RC0, <= v1.7.0-RC0 or >= v0.5.0, <= v0.5.0 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.0, <= v0.1.0
- Patched version
- Not yet available
Alluxio npm package versions from v0.1.0 to v2.9.5 are under investigation for a critical vulnerability that allows unauthenticated attackers to spoof user identities.
What happened
Alluxio's S3 REST proxy is reportedly failing to verify AWS Signature Version 4 signatures in its default configuration. This vulnerability, tracked as CVE-2026-79787, allows attackers to extract usernames from unsigned Authorization headers and impersonate any user, including service accounts. Attackers can then read, write, and delete arbitrary data. The affected versions span from v0.1.0 to v2.9.5. No exploitation in the wild has been confirmed at this time.
The vulnerability was first flagged on 2026-08-25. The CVSS score is 9.8, indicating a critical severity level. The National Vulnerability Database (NVD) lists this as a CRITICAL vulnerability.
What to do about it
- Monitor the primary sources for updates on a fixed version of Alluxio.
- Review and strengthen access controls for the S3 REST proxy in your environment.
- Consider implementing additional verification steps for AWS Signature Version 4 signatures if possible.
- Stay informed about any updates or patches released by the Alluxio project.
- Consult the NVD and OSV for the latest information on CVE-2026-79787.
How 0Day would have caught this
alluxio is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Alluxio npm package versions from v0.1.0 to v2.9.5, you may be affected by this vulnerability.
What should I do right now?
Monitor the primary sources for updates on a fixed version of Alluxio and review your access controls for the S3 REST proxy.
Is there a patched version available?
No official fix has been published yet. Monitor the sources for updates.
How severe is this vulnerability?
The CVSS score is 9.8, indicating a critical severity level.