CVE-2026-84366: CVE-2026-84366: Plaintext AWS Credential Exposure in Scrapy S3DownloadHandler

#security #cve #cybersecurity

CVE-2026-84366: Plaintext AWS Credential Exposure in Scrapy S3DownloadHandler

Vulnerability ID: CVE-2026-84366
CVSS Score: 7.4
Published: 2026-09-02

A security vulnerability in Scrapy's Amazon S3 download handler allows unencrypted transmission of sensitive AWS credentials and session tokens over plaintext HTTP. Prior to version 2.17.0, the handler defaulted to HTTP instead of HTTPS when translating s3:// URIs into standard S3 API requests, unless explicitly configured otherwise. This allows network eavesdroppers to intercept credentials and perform active Man-in-the-Middle (MITM) attacks.

TL;DR

Scrapy's S3 downloader prior to 2.17.0 transmitted signed AWS S3 requests over unencrypted HTTP by default, exposing AWS credentials and payloads to eavesdroppers.

Technical Details

CWE ID: CWE-319
Attack Vector: Network (AV:N)
CVSS Score: 7.4 (High)
EPSS Score: 0.00160
Exploit Status: none
KEV Status: Not Listed

Affected Systems

Scrapy framework (Python)
Scrapy: < 2.17.0 (Fixed in: 2.17.0)

Code Analysis

Commit: 9523e1e

Fix S3DownloadHandler to use HTTPS by default

@@ -49,7 +49,7 @@ def __init__(self, crawler: Crawler):

     async def download_request(self, request: Request) -> Response:
         p = urlparse_cached(request)
-        scheme = "https" if request.meta.get("is_secure") else "http"
+        scheme = "http" if request.meta.get("is_secure") is False else "https"
         bucket = p.hostname
         path = p.path + "?" + p.query if p.query else p.path
         url = f"{scheme}://{bucket}.s3.amazonaws.com{path}"

Mitigation Strategies

Upgrade Scrapy to version 2.17.0 or higher.
Explicitly set request metadata parameter 'is_secure' to True in custom requests.
Implement AWS bucket policies requiring secure transport (aws:SecureTransport check).

Remediation Steps:

Identify any active Scrapy projects using S3 integration.
Update requirements files to reference scrapy>=2.17.0.
Deploy the updated code to production environments.
Verify traffic to *.s3.amazonaws.com uses HTTPS (port 443) exclusively.

References

Read the full report for CVE-2026-84366 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community