Is CVE-2026-79782 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79782 being exploited in the wild.

How severe is CVE-2026-79782?

Low severity, with a CVSS score of 3.1, published 25 August 2026.

Which products and versions are affected?

github.com/rclone/rclone (Go) SEMVER:introduced=0,fixed=1.74.4; Rclone before 1.74.4.

Is there a fix for CVE-2026-79782?

Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79782 attacked?

It is attacked from the adjacent network or over the network, in a software library.

Am I affected by CVE-2026-79782?

Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79782: rclone S3 security token disclosure on HTTPS-to-HTTP redirect

CVE-2026-79782 · Severity: low · CVSS 3.1 · Published 2026-08-25

rclone is a command-line tool for syncing files to cloud storage, including AWS S3. When an S3 endpoint redirects a request from HTTPS to HTTP on the same hostname, rclone fails to strip the AWS session token from the request, sending sensitive credentials over unencrypted plaintext HTTP. An attacker positioned to observe network traffic could capture these temporary credentials and use them to access S3 data until the token expires.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-79782 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79782 being exploited in the wild.
How severe is CVE-2026-79782?: Low severity, with a CVSS score of 3.1, published 25 August 2026.
Which products and versions are affected?: github.com/rclone/rclone (Go) SEMVER:introduced=0,fixed=1.74.4; Rclone before 1.74.4.
Is there a fix for CVE-2026-79782?: Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79782 attacked?: It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2026-79782?: Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rclone/rclone (Go): upgrade to 1.74.4 or later
```
go get github.com/rclone/rclone@v1.74.4
```

Technical details

The vulnerability is a cleartext transmission flaw (CWE-319) in rclone's S3 backend redirect handling. The s3RedirectCrossesHost function in backend/s3/s3.go compares only the hostname and port when deciding whether to strip the X-Amz-Security-Token header, but does not compare the URL scheme. A redirect from https://host to http://host on the same hostname therefore fails to trigger token stripping, and the AWS STS session token is re-sent over plaintext HTTP. The attack requires network-level access to observe the unencrypted traffic, or control of the S3 endpoint to trigger the redirect (no user interaction required). An attacker can capture valid STS session tokens and impersonate the rclone user against AWS S3 or compatible services. The fix is to also compare URL.Scheme in the redirect policy; patched in version 1.74.4.

Affected products

rclone rclone before 1.74.4

Identifiers

CVE-2026-79782
GHSA-gx4c-2hqx-cw2r
GO-2026-6196

Timeline

2026-07-08: disclosed: GHSA-gx4c-2hqx-cw2r published
2026-08-25: patched: Version 1.74.4 released with fix
2026-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.