CVE-2026-79780

rclone before v1.75.0 Credential Exposure via S3 Redirect

Published Aug 25, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

Analysis

Technical impact

rclone versions before 1.75.0 do not sanitize IBM IAM bearer tokens and SSE-C encryption keys when handling S3 redirect callbacks, which can preserve those secrets across scheme changes or host modifications. This flaw can expose authenticating tokens that grant access to protected S3 objects.

Affected Systems

The vulnerability affects all rclone rclone releases prior to 1.75.0 that use IBM Cloud Object Storage with redirect callbacks. Users employing S3 redirect features with IBM IAM tokens or SSE-C keys are at risk.

Risk and Exploitability

The flaw carries a CVSS score of 6.0, indicating a moderate impact. With an EPSS score of 0.00095 (less than 1%), the lack of an entry in the CISA KEV catalog suggests limited documented exploitation. An attacker who can observe traffic from a trusted endpoint—for example, during same-host HTTPS-to-HTTP downgrades or cross-origin redirect flows—can capture reusable IBM IAM tokens or SSE-C keys, gaining unauthorized access to S3 data. The primary attack vector is network eavesdropping during redirect callbacks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rclone

unaffected

Version	Status	Constraints
`0`	affected	< 1.75.0
`1.75.0`	unaffected	—

No data.

Vendor Product Versions

Rclone

Version	Status	Scheme	Platform
`[0,1.75.0)`	affected	semver	—
`1.75.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade rclone to version 1.75.0 or newer.
Configure redirect callbacks to enforce HTTPS and limit redirections to trusted hosts.
Monitor network traffic for unexpected scheme or host changes during S3 redirect operations.

Generated by OpenCVE AI on August 31, 2026 at 14:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.147% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4
https://nvd.nist.gov/vuln/detail/CVE-2026-79780
https://www.cve.org/CVERecord?id=CVE-2026-79780
https://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect

History

Aug 31, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-201
References		https://nvd.nist.gov/vuln/detail/CVE-2026-79780 https://www.cve.org/CVERecord?id=CVE-2026-79780
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 25, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.
Title		rclone before v1.75.0 Credential Exposure via S3 Redirect
First Time appeared		Rclone Rclone rclone
Weaknesses		CWE-200
CPEs		cpe:2.3:a:rclone:rclone::::::::
Vendors & Products		Rclone Rclone rclone
References		https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4 https://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`