Technical impact
Rclone before version 1.75.2 contains a credential exposure flaw in the B2 backend that can leak the live account Authorization token and server‑side encryption customer (SSE‑C) keys when HTTP redirects occur from the --b2-download-url hosts. The flaw allows an attacker to capture the clear‑text token and encryption keys, potentially giving full access to the B2 account and any data encrypted with those keys. The impact is confidentiality loss of both the token and the encryption keys required to decrypt user data stored in B2.
Affected Systems
The affected product is the rclone tool, specifically all releases prior to 1.75.2. The vulnerability is confined to the B2 backend and manifests when using the --b2-download-url flag, so any installation of rclone that relies on B2 and has not been updated to 1.75.2 or newer is at risk.
Risk and Exploitability
The CVSS score of 6 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not a known widely exploited vulnerability. The likely attack vector involves an attacker observing or manipulating redirects that downgrade an HTTPS connection to HTTP on the same host or trigger cross‑host redirects, thereby capturing the exposed credentials in transit. Because the redirection occurs over the network, the vulnerability can be exploited remotely by anyone who can observe the traffic or influence the redirect path. While exploitation requires the attacker to trigger the redirect, the lack of additional authentication or privilege checks makes the exposure straightforward once the redirect occurs.
