{"id":"EUVD-2026-29205","enisaUuid":"6e35fe26-b319-3410-9023-457363269501","description":"oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns\nthat match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go\u0027s URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.","datePublished":"May 11, 2026, 7:26:44 PM","dateUpdated":"May 13, 2026, 2:40:36 PM","baseScore":9.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-rfgq-wgg8-662p\nhttps://github.com/oxyno-zeta/s3-proxy/commit/1320e4abd46ad18c2851fedde50dbb79df8b7a51\nhttps://github.com/oxyno-zeta/s3-proxy/commit/af5ff57d8c6022459495b8fb50130073bca7b48a\n","aliases":"CVE-2026-42882\nGHSA-rfgq-wgg8-662p\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"280f25be-b8ab-310f-b7f2-28c3741c29b4","product":{"name":"s3-proxy","vendor":{"name":"oxyno-zeta"}},"product_version":"\u003c 5.0.0"}],"enisaIdVendor":[{"id":"57a337de-f0ee-3a94-be8e-1725acec530f","vendor":{"name":"oxyno-zeta"}}],"enisaIdVulnerability":[{"id":"d7c26d54-1bf9-396f-ab02-4e10284807b7","vulnerability":{"id":"CVE-2026-42882","description":"oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns\nthat match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go\u0027s URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.","datePublished":"May 11, 2026, 7:26:44 PM","dateUpdated":"May 13, 2026, 2:40:36 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-rfgq-wgg8-662p\nhttps://github.com/oxyno-zeta/s3-proxy/commit/1320e4abd46ad18c2851fedde50dbb79df8b7a51\nhttps://github.com/oxyno-zeta/s3-proxy/commit/af5ff57d8c6022459495b8fb50130073bca7b48a\n","enisa_id":"EUVD-2026-29205\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 3, 2026, 7:16:55 AM","vulnerabilityProduct":[{"id":"e514654f-07ff-3731-872d-2ce828c80d8a","product":{"name":"s3-proxy","vendor":{"name":"oxyno-zeta"}},"product_version":"\u003c 5.0.0"}],"vulnerabilityVendor":[{"id":"3fa6120d-9fb5-39d0-8acc-f430854b2fd8","vendor":{"name":"oxyno-zeta"}}]}},{"id":"e12f2346-6441-33f0-80b8-6f394dd5410a","vulnerability":{"id":"GHSA-rfgq-wgg8-662p","description":"S3-Proxy has Security Issues in its Resource Path Matching Implementation","datePublished":"May 5, 2026, 6:52:56 PM","dateUpdated":"May 13, 2026, 2:19:05 PM","baseScore":0.0,"references":"https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-rfgq-wgg8-662p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42882\nhttps://github.com/oxyno-zeta/s3-proxy/commit/1320e4abd46ad18c2851fedde50dbb79df8b7a51\nhttps://github.com/oxyno-zeta/s3-proxy/commit/af5ff57d8c6022459495b8fb50130073bca7b48a\nhttps://github.com/oxyno-zeta/s3-proxy\n","enisa_id":"EUVD-2026-29205\n","aliases":"GHSA-rfgq-wgg8-662p\nCVE-2026-42882\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}