CVE-2026-84366

Received Received - Intake

Information Disclosure in Scrapy S3DownloadHandler

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta["is_secure"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84366

Affected Vendors & Products

Vendor	Product	Version / Range
scrapy	scrapy	2.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability in Scrapy before version 2.17.0 involves S3DownloadHandler converting S3-scheme requests into plaintext HTTP requests unless explicitly secured. This exposes sensitive data like AWS credentials, bucket paths, and S3 object contents to network attackers who can observe traffic. Attackers can also modify responses, leading to data poisoning or cache poisoning.

Detection Guidance

Detect this vulnerability by checking Scrapy versions prior to 2.17.0 and inspecting network traffic for plaintext S3 requests. Use commands like 'pip show scrapy' to verify the version and 'tcpdump' or 'Wireshark' to monitor unencrypted S3 traffic.

Impact Analysis

If you use Scrapy with AWS credentials for S3 requests, attackers could intercept and read sensitive data such as AWS credentials, bucket paths, and S3 object contents. They could also alter responses, causing data poisoning, cache poisoning, or redirecting crawls to malicious targets.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of AWS credentials may also breach compliance with data handling and access control policies.

Mitigation Strategies

Upgrade Scrapy to version 2.17.0 or later. Ensure all S3-scheme requests include request.meta['is_secure']=True to enforce HTTPS. Review and rotate AWS credentials if exposed.

Hi! I’m here to help you understand CVE-2026-84366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70