oxyno-zeta/s3-proxy Critical Auth Bypass (CVE-2026-42882)

A critical authentication bypass (CVE-2026-42882) has been identified in oxyno-zeta/s3-proxy, a Go-based AWS S3 proxy. The National Vulnerability Database reports that versions prior to 5.0.0 are vulnerable due to an inconsistency in URL path interpretation between the authentication middleware and the bucket handler. Specifically, the authentication layer processes percent-encoded URIs, while the S3 object key construction uses the decoded path. This mismatch, coupled with improper glob library usage, creates a severe security flaw.

This vulnerability allows unauthenticated attackers to perform unauthorized PUT, GET, or DELETE operations on objects within protected S3 namespaces. The National Vulnerability Database outlines three distinct exploitation techniques: path traversal using * patterns across path separators, leveraging percent-encoded slashes (%2F) to bypass authentication, and exploiting dot-dot segments (../) under prefix patterns. The impact is direct and severe: data exfiltration, modification, or deletion without any authentication, rated with a CVSS score of 9.4 (CRITICAL).

For defenders, this is a clear and present danger. An unauthenticated attacker with network access can bypass all controls. The fix is in version 5.0.0. If you’re running this proxy, patching is not optional; it’s an immediate requirement. This isn’t theoretical – it’s a fundamental design flaw that’s ripe for exploitation. Any organization using this proxy is exposed.