Authentication Bypass in S3 Proxy by Oxyno-Zeta

CVE-2026-42882

What is CVE-2026-42882?

The S3 Proxy by Oxyno-Zeta, an AWS S3 proxy implemented in Go, contains an authentication bypass vulnerability due to inconsistent URL path interpretation. This issue arises in versions prior to 5.0.0, where the authentication middleware and the bucket handler process URL paths differently. Attackers can exploit this flaw to perform unauthorized actions such as reading, deleting, or writing objects in secure S3 namespaces. By leveraging specific URL patterns, percent-encoded slashes, or dot-dot segments, unauthenticated users can bypass authentication mechanisms. This vulnerability poses a significant risk to users relying on S3 for secure data handling and requires immediate attention and upgrading to version 5.0.0 or higher.

References