Scrapy S3DownloadHandler Vulnerable to Credential Exposure via Plaintext HTTP

The Scrapy web crawling framework contains a security vulnerability (CVE-2026-84366) in its S3DownloadHandler component. By default, when a user initiates a request to an s3:// URI, the handler constructs an HTTP URL (http://bucket.s3.amazonaws.com/key) unless the request.meta["is_secure"] flag is explicitly set to True. Because the request is signed with the user's AWS credentials before being dispatched, the authorization headers and security tokens are transmitted over plaintext HTTP. This behavior persists in all versions of Scrapy prior to 2.17.0.

This issue is particularly critical for environments where Scrapy workers operate in untrusted network segments or where traffic is subject to interception. Attackers capable of observing or intercepting network traffic can capture valid AWS credentials or perform full Man-in-the-Middle (MITM) attacks to manipulate data being scraped, potentially leading to downstream data poisoning or influence over the crawl process.

Impact

Successful exploitation allows a network attacker to capture sensitive AWS authorization material, including long-lived IAM keys or temporary session tokens (via X-Amz-Security-Token). Additionally, the ability to perform MITM attacks against the plaintext stream enables the injection of malicious content into the scraped dataset, the corruption of HTTP caches, and the redirection of crawlers to attacker-controlled targets. This vulnerability affects any organization utilizing Scrapy to interact with S3-compatible storage using IAM-based authentication.

Recommendation

• Upgrade Scrapy to version 2.17.0 or later immediately to resolve the default insecure connection behavior.
• Audit existing Scrapy spiders for usage of s3:// URIs and explicitly set request.meta["is_secure"] = True for all S3 requests if an immediate upgrade is not feasible.
• Implement network-level egress filtering and enforce TLS for all outgoing storage traffic to detect or prevent non-encrypted AWS API communications.
• Rotate any AWS IAM credentials that have been used by Scrapy instances operating in environments susceptible to network eavesdropping.