CVE-2026-79782

LOW 3.1

rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

CWE	CWE-319
Vendor	rclone
Product	rclone
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new low vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

rclone / rclone

0 < 1.74.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r vulncheck.com: https://www.vulncheck.com/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect

Credits

🔍 iaohkut-from-NightWolf-Team ncw