CVE-2026-40344: Snowball Auto-Extract Authentication Bypass

A Snowball unsigned-trailer request could reach the extractor before authentication; the fix verifies SigV4 before any tar byte crosses that boundary.
By Ruohang Feng |
Tags:

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-9c4q-hq6p-c237

Snowball’s PutObjectExtractHandler omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature could enter untar() before authentication completed, and one request could fan out into many object writes. The final fix initialized the correct reader, handled the decoded length, and completed SigV4 verification before any tar byte reached the extractor.

Why the identifier changed

The official CVE had not been assigned when the fix was written, so the commit subject used the temporary identifier fake CVE-2026-40028. The final identifier is CVE-2026-40344. The historical commit was not rewritten; the advisory and this article use the official number.

From one missing authentication case to bulk object writes

The entry point was Snowball / PutObjectExtract auto-extraction. The request used unsigned-trailer streaming, an authentication type the old handler did not cover as ordinary PUT did.

The danger was larger than one incorrectly authorized request. Once the tar stream entered untar(), that request could create multiple attacker-chosen objects. An authentication omission was therefore amplified into a bulk-write problem.

Final invariant: the extractor sees zero bytes on failure

The key statement in the fix was:

If authentication ultimately fails, untar() must have seen zero bytes.

That rule excludes “extract first, then roll back if authentication fails.” Object writes travel through several paths, and proving a complete rollback is much harder than proving that input never crossed the boundary. Authentication had to close before data entered the extractor.

Implementation

The final change:

  • recognized authTypeStreamingUnsignedTrailer;
  • read X-Amz-Decoded-Content-Length;
  • used newUnsignedV4ChunkedReader();
  • performed complete SigV4 request verification before entering untar();
  • preserved valid signed Snowball requests and CRC32 trailer flows.

Verification

The historical commit and investigation record cover:

  • rejection of a forged-signature Snowball unsigned-trailer request;
  • rejection of anonymous Snowball writes to a non-public bucket;
  • successful extraction with a valid signature and trailing CRC32;
  • red/green comparison between the vulnerable parent and the patched tree;
  • containerized before/after smoke tests.

The public fix is b50ab58. The container tests were not rerun while preparing this article.

Compatibility and residual risk

  • Clients that relied on an unsigned-trailer Snowball combination whose signature was never really verified will fail after upgrading.
  • Authentication now closes before extraction, but tar paths, archive-size limits, and object-count limits remain separate security surfaces.
  • Snowball and ordinary unsigned-trailer requests now share a reader; future changes must regress both paths together.

The essence of the fix was not another if. It moved the authentication decision in front of the actual amplification boundary.

Last modified August 2, 2026: init commit (8338d5b)