CVE-2026-79780: rclone before v1.75.0 Credential Exposure via S3 Redirect
rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.
Affected Software
Event History
Frequently Asked Questions
Which credentials can be exposed, and under what redirect conditions?
IBM IAM bearer tokens can be retained on same-host redirects that downgrade from HTTPS to HTTP. SSE-C encryption keys can be retained when redirects cross to a different origin.
What must an attacker be able to do to exploit this issue?
An attacker must be able to observe network traffic from a trusted endpoint while rclone follows a relevant S3 redirect. No privileges or user interaction are required, but the attack complexity is high.
Who should prioritize remediation?
Prioritize systems using rclone with S3, particularly those using IBM IAM bearer tokens or SSE-C encryption keys and communicating with endpoints that may issue redirects. Exposure can allow captured credentials to be reused to access protected S3 objects.
What version resolves the issue?
Upgrade rclone to version 1.75.0 or later. The issue affects versions before 1.75.0.