Executive brief
rclone is a command-line tool for syncing files to cloud storage, including AWS S3. When an S3 endpoint redirects a request from HTTPS to HTTP on the same hostname, rclone fails to strip the AWS session token from the request, sending sensitive credentials over unencrypted plaintext HTTP. An attacker positioned to observe network traffic could capture these temporary credentials and use them to access S3 data until the token expires.
Technical details
The vulnerability is a cleartext transmission flaw (CWE-319) in rclone's S3 backend redirect handling. The s3RedirectCrossesHost function in backend/s3/s3.go compares only the hostname and port when deciding whether to strip the X-Amz-Security-Token header, but does not compare the URL scheme. A redirect from https://host to http://host on the same hostname therefore fails to trigger token stripping, and the AWS STS session token is re-sent over plaintext HTTP. The attack requires network-level access to observe the unencrypted traffic, or control of the S3 endpoint to trigger the redirect (no user interaction required). An attacker can capture valid STS session tokens and impersonate the rclone user against AWS S3 or compatible services. The fix is to also compare URL.Scheme in the redirect policy; patched in version 1.74.4.
Affected products
- rclone rclone before 1.74.4
Timeline
- 2026-07-08: disclosed: GHSA-gx4c-2hqx-cw2r published
- 2026-08-25: patched: Version 1.74.4 released with fix
- 2026-08-25: advisory