CVE-2026-42882: s3-proxy authentication bypass via path interpretation mismatch
CVE-2026-42882 affects oxyno-zeta/s3-proxy before 5.0.0. The authentication middleware and the bucket handler interpret the same request path differently, which can let unauthenticated network attackers reach protected S3 namespaces. The record describes a CVSS 3.1 score of 9.4 and a fix in 5.0.0; no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-42882 is a path-handling flaw in oxyno-zeta/s3-proxy, an AWS S3 proxy written in Go. According to the record, the authentication middleware and the bucket handler derive different paths from the same request, so access checks may not match the object actually accessed. The weakness is classified as CWE-22 (Path Traversal).
Impact
The record states that an unauthenticated attacker with network access can perform unauthorized PUT, GET or DELETE operations on objects in namespaces that are supposed to require authentication. The CNA assigned a CVSS 3.1 base score of 9.4 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, which corresponds to high confidentiality and integrity impact and low availability impact.
Affected products and versions
- Product: oxyno-zeta/s3-proxy.
- Affected versions: the description says versions prior to 5.0.0.
- Fixed version: 5.0.0, as stated in the description.
- The structured affected and fixes fields in the record are empty, so the version range is taken only from the description text.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00719 with a percentile of 0.5265, a figure that estimates likelihood and does not confirm exploitation.
Remediation and mitigation
- Upgrade s3-proxy to version 5.0.0 or later, as indicated by the description and the upstream advisory.
- Review the upstream advisory GHSA-rfgq-wgg8-662p and the referenced commits 1320e4a and af5ff57 to confirm the scope of the change.
- Until patching is possible, limit network exposure of the proxy so that only trusted clients can reach it, and treat protected buckets as at risk.
- Verify bucket and object integrity for sensitive namespaces that were reachable through the proxy.
Detection guidance
- Review proxy and reverse-proxy logs for requests to protected namespaces that lack valid authentication, especially requests containing encoded separators or dot-dot segments.
- Alert on unexpected object creation, modification or deletion in buckets served by the proxy, particularly when the originating request is not associated with an authenticated identity.
- Correlate storage-side audit events with proxy access logs to identify operations that succeeded without a matching authenticated session.
Limitations of the available information
The record does not include structured affected version ranges, fixed version lists, or the full text of the advisory and commits. Whether earlier releases are affected is unknown beyond the phrase prior to 5.0.0. The title was missing in the source record, so the title here is a derived summary. No public proof of concept or in-the-wild activity was found in the sources consulted.
Frequently asked questions
Which versions of s3-proxy are affected by CVE-2026-42882?
The description states that versions prior to 5.0.0 are affected. The structured affected version list in the record is empty, so the exact range is taken from that description only.
Is CVE-2026-42882 being actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Upgrade s3-proxy to version 5.0.0 or later, limit network exposure of the proxy until patched, and review logs and bucket changes for unexpected activity.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.