Executive brief
rclone is a cloud storage synchronization tool widely used to manage data across cloud providers including Amazon S3. When rclone follows HTTP redirects during S3 operations, it fails to remove sensitive credentials (IBM IAM bearer tokens and encryption keys) before making requests to new endpoints, allowing an attacker observing network traffic to intercept and reuse these credentials to access protected data.
Technical details
This vulnerability is a credential exposure issue (CWE-200, CWE-319) in rclone's S3 redirect handling callback (backend/s3/s3.go:1345-1379). The s3CheckRedirect function strips only the X-Amz-Security-Token header on cross-host redirects, but fails to sanitize IBM IAM Authorization: Bearer tokens or SSE-C/copy-source SSE-C encryption key headers. An attacker positioned on the network path can exploit this via: (1) same-host HTTPS-to-HTTP downgrades to capture plaintext IBM IAM bearer tokens, reusable within that token's IAM scope; or (2) cross-origin redirects to capture SSE-C encryption keys and access corresponding ciphertext. The attack requires network-adjacent positioning and a redirect from a trusted endpoint. Patch is available in rclone v1.75.0.
Affected products
- rclone rclone before v1.75.0
Timeline
- 2026-07-31: disclosed: GitHub Security Advisory GHSA-8mxv-9xhp-86h4 published
- 2026-08-25: advisory: CVE-2026-79780 published
- 2026-07-31: patched: Fix released in v1.75.0