CVE-2026-79782 in Rclone
Summary
by MITRE • 08/25/2026
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in rclone versions prior to 1.74.4 represents a critical security flaw related to improper handling of authentication credentials during protocol redirections involving Amazon S3 storage services. This issue specifically arises when an S3 redirect operation causes the connection scheme to transition from HTTPS to HTTP while maintaining the same host address. In such scenarios, rclone fails to strip or sanitize sensitive headers before transmitting them over the now unencrypted channel. The primary header at risk is X-Amz-Security-Token, which contains temporary security credentials issued by AWS Security Token Service (STS). These tokens are essential for authenticating requests and granting access to cloud resources, making their exposure a severe compromise of confidentiality and integrity.
From a technical perspective, the flaw stems from rclone's logic when following HTTP redirects. When an S3 bucket or object returns a redirect response indicating that subsequent requests should be made over plain HTTP instead of HTTPS on the same host, rclone proceeds to forward all original request headers without filtering out sensitive authentication data. This behavior violates fundamental security principles regarding credential handling in untrusted channels. The X-Amz-Security-Token header is designed for secure transmission only; its presence in plaintext HTTP traffic allows any network observer with access to that segment of the communication path to capture these tokens. This can occur due to man-in-the-middle attacks, compromised routers, or malicious actors monitoring local network traffic if the user's environment permits such interception.
The operational impact of this vulnerability is significant for organizations relying on rclone for cloud storage synchronization and backup operations. If an attacker successfully intercepts the plaintext HTTP traffic, they obtain valid AWS STS session tokens. These tokens can be used to authenticate as the compromised identity, potentially granting unauthorized access to S3 buckets, DynamoDB tables, or other AWS services associated with those credentials. Depending on the permissions attached to the temporary role, this could lead to data exfiltration, modification of stored objects, or further lateral movement within an organization's cloud infrastructure. The risk is exacerbated because STS tokens often have limited lifespans but high privileges during their validity period, making them attractive targets for immediate exploitation.
This vulnerability aligns with CWE-319, which classifies the use of cleartext communication without integrity checks or encryption on a sensitive channel. It also relates to CWE-524, concerning the exposure of cacheable private data in HTTP responses, although here the issue is more directly tied to header leakage during redirection rather than caching mechanisms. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITM01 from the ATT&CK framework, where attackers intercept and potentially modify network traffic between two entities who believe they are directly communicating. The lack of automatic stripping of sensitive headers upon protocol downgrade represents a failure in secure configuration defaults that should be inherent to tools handling cloud credentials.
To mitigate this risk, users must upgrade rclone to version 1.74.4 or later, where the developers have implemented logic to strip the X-Amz-Security-Token header when switching from HTTPS to HTTP on the same host. This ensures that even if a redirect occurs over an unencrypted channel, sensitive authentication data is not transmitted in plaintext. Additionally, administrators should enforce strict policies requiring HTTPS for all S3 interactions by configuring bucket policies or using VPC endpoints where possible, thereby reducing the likelihood of encountering such redirects altogether. Regular auditing of rclone configurations and ensuring that tools are kept up to date with security patches are essential practices for maintaining robust cloud storage hygiene. Organizations should also monitor their network traffic for anomalies indicative of credential interception and implement least-privilege principles for IAM roles used by automated backup or sync jobs to limit the blast radius in case of a token compromise.