CVE-2026-79780
Received Received - Intake

rclone Credential Exposure via S3 Redirect Callback

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79780
EUVD
EUVD-2026-65538

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rclone rclone to 1.74.0 (inc)
rclone rclone to 1.75.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

rclone before v1.75.0 fails to remove IBM IAM bearer tokens and SSE-C encryption keys during S3 redirects. This allows credentials to leak when network traffic is observed during HTTPS-to-HTTP downgrades or cross-origin redirects, potentially exposing sensitive S3 objects.

Detection Guidance

Monitor network traffic for S3 redirects involving rclone, particularly HTTPS-to-HTTP downgrades or cross-origin redirects. Look for preserved IBM IAM bearer tokens or SSE-C encryption keys in headers during redirects. Use packet capture tools like tcpdump or Wireshark to inspect headers for sensitive data exposure.

Impact Analysis

Attackers could capture reusable IBM IAM tokens to perform unauthorized S3 operations like reads, writes, or deletes. SSE-C encryption keys could also be exposed, allowing access to encrypted data if intercepted during redirects.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's principles of data protection and integrity (Article 5) and HIPAA's requirements for safeguarding protected health information. Exposure of IBM IAM tokens or SSE-C encryption keys could result in data breaches, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies

Upgrade rclone to v1.75.0 or later. Configure rclone to reject HTTPS-to-HTTP redirects and avoid following cross-origin redirects with sensitive headers. Ensure all authorization headers, cookies, tokens, and encryption keys are stripped during any scheme, host, or port changes. Only allow redirects to whitelisted destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart