Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-25T15:16:09 github.com/rclone/rclone: rclone: Information disclosure via S3 redirect callbacks 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-201

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

A flaw was found in rclone. The application fails to properly sanitize IBM IAM bearer tokens and Server-Side Encryption with Customer-Provided Keys (SSE-C) encryption keys during S3 redirect callbacks. This allows credentials to be preserved across scheme or host changes. A remote attacker observing network traffic from a trusted endpoint could capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects, leading to information disclosure and potential unauthorized access to protected S3 objects.

This Moderate flaw in rclone allows for information disclosure of IBM IAM bearer tokens or SSE-C encryption keys. When rclone interacts with S3 endpoints that issue unsafe redirects, an adjacent network attacker can capture these credentials during HTTPS-to-HTTP downgrades or cross-origin redirects. The impact is constrained by the scope of the captured token and the attacker's access to encrypted objects. Until packages are updated, avoid using rclone S3 remotes with IBM IAM bearer tokens or SSE-C customer-provided keys against endpoints or gateways that issue cross-scheme or cross-host redirects. Prefer trusted HTTPS endpoints that do not downgrade or redirect secret-bearing requests. Cryostat 4 Fix deferred cryostat/cryostat-storage-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/volsync-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-79780 https://nvd.nist.gov/vuln/detail/CVE-2026-79780 https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4 https://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect