by Kastro
Paper/Archive/CVE-2026-79782

CVE-2026-79782

rclone rclone — rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 2.7.027 × 200.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

Affected

ProductAffectedFixed inSource
rclone< 1.74.41.74.4CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)3.1CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2rwriteupvulncheck.com/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect