Executive brief
rclone is a command-line program used to manage files on cloud storage. A security flaw in its S3 storage connector could allow an attacker to intercept temporary AWS security tokens if the storage server redirects a secure connection to an unsecure one. If these tokens are captured, an unauthorized person could gain temporary access to the user's cloud storage data.
Technical details
A vulnerability exists in the S3 backend of rclone where the `s3RedirectCrossesHost` function in `backend/s3/s3.go` only validates changes in the hostname and port during HTTP redirects. It fails to check for scheme downgrades (HTTPS to HTTP). Consequently, if an S3-compatible endpoint issues a redirect from HTTPS to HTTP on the same host, the `X-Amz-Security-Token` (AWS STS session token) is re-transmitted over an unencrypted connection. An attacker positioned on the network path could capture this token to gain unauthorized access to the S3 resources for the duration of the token's validity. This issue is addressed in version 1.74.4 by ensuring the redirect policy also compares the URL scheme.
Affected products
- rclone rclone <= 1.74.3
Timeline
- disclosed: Reported by iaohkut-from-NightWolf-Team
- 2026-07-08: patched: Fixed in version 1.74.4
- 2026-08-05: advisory: GitHub Advisory published
References
- https://api.github.com/users/iaohkut-from-NightWolf-Team
- https://github.com/iaohkut-from-NightWolf-Team
- https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D
- https://api.github.com/users/iaohkut-from-NightWolf-Team/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D