Alluxio vulnerabilities
We track 2 vulnerabilities in Alluxio products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score
Latest Alluxio vulnerabilities
- 9.8 Critical severity
alluxio: Improper Authentication
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, in
- 9.8 Critical severity
Alluxio: Improper Control of Generation of Code
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).