https://vulnerability.circl.lu/sightings/feed 2026-09-03T18:55:31.680403+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/50f33f2d-43d9-4d3d-9d8a-d3671b37d72b/export 2026-09-03T18:55:31.701453+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "50f33f2d-43d9-4d3d-9d8a-d3671b37d72b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84366", "type": "seen", "source": "https://gist.github.com/alon710/8ee7b622d5b0dab3696cbd7281b1320e", "content": "# CVE-2026-84366: CVE-2026-84366: Plaintext AWS Credential Exposure in Scrapy S3DownloadHandler\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84366\n\n## Summary\nA security vulnerability in Scrapy's Amazon S3 download handler allows unencrypted transmission of sensitive AWS credentials and session tokens over plaintext HTTP. Prior to version 2.17.0, the handler defaulted to HTTP instead of HTTPS when translating s3:// URIs into standard S3 API requests, unless explicitly configured otherwise. This allows network eavesdroppers to intercept credentials and perform active Man-in-the-Middle (MITM) attacks.\n\n## TL;DR\nScrapy's S3 downloader prior to 2.17.0 transmitted signed AWS S3 requests over unencrypted HTTP by default, exposing AWS credentials and payloads to eavesdroppers.\n\n## Technical Details\n\n- **CWE ID**: CWE-319\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.4 (High)\n- **EPSS Score**: 0.00160\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Scrapy framework (Python)\n- **Scrapy**: < 2.17.0 (Fixed in: `2.17.0`)\n\n## Mitigation\n\n- Upgrade Scrapy to version 2.17.0 or higher.\n- Explicitly set request metadata parameter 'is_secure' to True in custom requests.\n- Implement AWS bucket policies requiring secure transport (aws:SecureTransport check).\n\n**Remediation Steps:**\n1. Identify any active Scrapy projects using S3 integration.\n2. Update requirements files to reference scrapy>=2.17.0.\n3. Deploy the updated code to production environments.\n4. Verify traffic to *.s3.amazonaws.com uses HTTPS (port 443) exclusively.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-84366)\n- [NVD Directory Details](https://nvd.nist.gov/vuln/detail/CVE-2026-84366)\n- [GitHub Security Advisory](https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx)\n- [Official Fix Commit](https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b)\n- [Scrapy 2.17.0 Release Page](https://github.com/scrapy/scrapy/releases/tag/2.17.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84366) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T00:00:27.435659Z"} 2026-09-03T00:00:27.435659+00:00 https://vulnerability.circl.lu/sighting/a7cfc2da-5a76-4e1a-8e1d-0d712fba2f7b/export 2026-09-03T18:55:31.703393+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a7cfc2da-5a76-4e1a-8e1d-0d712fba2f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84366", "type": "seen", "source": "https://gist.github.com/alon710/8ee7b622d5b0dab3696cbd7281b1320e", "content": "# CVE-2026-84366: CVE-2026-84366: Plaintext AWS Credential Exposure in Scrapy S3DownloadHandler\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84366\n\n## Summary\nA security vulnerability in Scrapy's Amazon S3 download handler allows unencrypted transmission of sensitive AWS credentials and session tokens over plaintext HTTP. Prior to version 2.17.0, the handler defaulted to HTTP instead of HTTPS when translating s3:// URIs into standard S3 API requests, unless explicitly configured otherwise. This allows network eavesdroppers to intercept credentials and perform active Man-in-the-Middle (MITM) attacks.\n\n## TL;DR\nScrapy's S3 downloader prior to 2.17.0 transmitted signed AWS S3 requests over unencrypted HTTP by default, exposing AWS credentials and payloads to eavesdroppers.\n\n## Technical Details\n\n- **CWE ID**: CWE-319\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.4 (High)\n- **EPSS Score**: 0.00160\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Scrapy framework (Python)\n- **Scrapy**: < 2.17.0 (Fixed in: `2.17.0`)\n\n## Mitigation\n\n- Upgrade Scrapy to version 2.17.0 or higher.\n- Explicitly set request metadata parameter 'is_secure' to True in custom requests.\n- Implement AWS bucket policies requiring secure transport (aws:SecureTransport check).\n\n**Remediation Steps:**\n1. Identify any active Scrapy projects using S3 integration.\n2. Update requirements files to reference scrapy>=2.17.0.\n3. Deploy the updated code to production environments.\n4. Verify traffic to *.s3.amazonaws.com uses HTTPS (port 443) exclusively.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-84366)\n- [NVD Directory Details](https://nvd.nist.gov/vuln/detail/CVE-2026-84366)\n- [GitHub Security Advisory](https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx)\n- [Official Fix Commit](https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b)\n- [Scrapy 2.17.0 Release Page](https://github.com/scrapy/scrapy/releases/tag/2.17.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84366) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T23:31:42.662700Z"} 2026-09-02T23:31:42.662700+00:00