rclone versions prior to 1.74.4 fail to remove the X‑Amz‑Security‑Token header when an S3 redirect changes the scheme from HTTPS to HTTP on the same host. As a result, requests that originally used secure transport are re‑sent over an unencrypted connection, exposing the AWS STS session token in clear text within the request header. The exposed token can be leveraged by an attacker to impersonate the authenticated user or to gain unauthorized access to AWS resources. The weakness is characterized by CWE‑319, which involves the improper handling of sensitive information in transport.

The vulnerability affects the rclone tool shipped before release 1.74.4. Users running any earlier version on any operating system are at risk. The affected product list includes rclone rclone and any distributions or packaged versions based on those upstream releases, as listed by the CNA. No specific platform restrictions are noted.

The CVSS base score of 9.3 signifies high severity, and the mechanism involves a publicly available redirect that can be triggered during normal S3 access. Because the issue arises when the same host is used for HTTPS to HTTP redirection, an attacker who can position themselves on the network path and capture plain HTTP traffic can steal the token. The EPSS score is not available, but the lack of public disclosures and the fact that the vulnerability is not catalogued in CISA’s KEV suggest that exploitation may be currently limited. Nonetheless, the high CVSS and the potential for token compromise imply that this risk should be treated as critical and mitigated without delay.