Executive brief
rclone, a popular command-line tool for managing files on cloud storage, fails to properly remove sensitive credentials when following certain web redirects. If a storage provider redirects a request from a secure connection to an insecure one, or to a different server, rclone may inadvertently send IBM IAM authentication tokens or private encryption keys to the new destination. An attacker positioned on the local network could intercept these secrets to gain unauthorized access to the user's cloud data or decrypt protected files.
Technical details
The rclone S3 backend implementation in `s3CheckRedirect` contains an incomplete credential sanitization logic. While it correctly strips `X-Amz-Security-Token` during cross-host redirects, it fails to remove IBM IAM bearer tokens (`Authorization` header) during HTTPS-to-HTTP redirects on the same host, and fails to remove Server-Side Encryption with Customer-Provided Keys (SSE-C) headers during cross-origin redirects. This occurs because the underlying Go HTTP client preserves the Authorization header on same-host redirects regardless of scheme changes, and rclone lacks specific logic to identify and strip SSE-C key headers. An attacker capable of observing network traffic (e.g., on an adjacent network) or controlling a redirect destination could capture these reusable secrets. The issue is fixed in version 1.75.0.
Affected products
- rclone rclone <= 1.74.0
Timeline
- 2026-07-31: disclosed
- 2026-08-05: advisory
- 2026-08-05: patched: Fixed in version 1.75.0