CVE-2026-79782: rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to token disclosure?
Users of rclone versions before 1.74.4 are exposed when making S3 requests that receive a redirect from HTTPS to HTTP on the same host. An attacker able to intercept the resulting plaintext HTTP traffic could capture the AWS STS session token.
What must an attacker be able to do to exploit this issue?
The attacker needs to cause or rely on an S3 redirect that changes the request scheme from HTTPS to HTTP while keeping the same host, and must be able to intercept the plaintext HTTP traffic. No authentication or user interaction is required according to the provided vector.
How can I remediate the issue?
Upgrade rclone to version 1.74.4 or later. The issue affects versions before 1.74.4.