CVE-2026-79780: rclone Information Disclosure Vulnerability

CVE-2026-79780 Overview

CVE-2026-79780 affects rclone versions prior to v1.75.0. The tool fails to sanitize IBM Identity and Access Management (IAM) bearer tokens and Server-Side Encryption with Customer-Provided Keys (SSE-C) during S3 redirect callbacks. Credentials persist across scheme or host changes when redirects occur. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades. They can also capture SSE-C keys on cross-origin redirects and use them to access protected S3 objects. The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Adjacent network attackers can capture reusable IBM IAM bearer tokens or SSE-C encryption keys and use them to access protected S3 objects.

Affected Products

rclone versions before v1.75.0
Deployments using IBM Cloud Object Storage with IAM bearer tokens
Deployments using S3-compatible backends with SSE-C encryption keys

Discovery Timeline

2026-08-25 - CVE-2026-79780 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79780

Vulnerability Analysis

The vulnerability resides in how rclone handles HTTP redirect responses returned by S3 endpoints. When an S3 backend responds with a redirect, the client follows the new location without stripping sensitive headers. The Authorization header containing IBM IAM bearer tokens and the SSE-C key headers travel with the redirected request. This behavior breaks the origin boundary expected for credential material.

An adversary positioned on the adjacent network can influence or observe redirect flows. On same-host HTTPS-to-HTTP downgrades, the IAM bearer token is transmitted in cleartext and can be captured off the wire. On cross-origin redirects, the SSE-C key is forwarded to a host that was never authorized to receive it. Both classes of leaked material remain valid for subsequent requests against the object store.

Root Cause

The root cause is missing sanitization of authentication and encryption headers during redirect callbacks. Standard HTTP client libraries typically strip credential-bearing headers on scheme or host changes. rclone did not apply this control to IBM IAM tokens or SSE-C headers before v1.75.0.

Attack Vector

Exploitation requires adjacent network access and specific conditions such as an attacker-controlled or attacker-observable redirect target. The attacker either intercepts a downgraded HTTPS-to-HTTP request on the same host or induces a redirect to a host under their control. Captured tokens and keys are then replayed against the S3 object store to read or manipulate protected objects. Refer to the GitHub Security Advisory GHSA-8mxv-9xhp-86h4 and the VulnCheck advisory for RClone S3 redirect credential exposure for additional technical detail.

Detection Methods for CVE-2026-79780

Indicators of Compromise

Outbound S3 requests from rclone hosts that follow 3xx redirects to unexpected hostnames or to http:// schemes
Cleartext HTTP traffic on the same host containing Authorization: Bearer headers associated with IBM IAM tokens
SSE-C headers such as x-amz-server-side-encryption-customer-key sent to hosts outside the configured S3 endpoint

Detection Strategies

Inspect proxy and firewall logs for rclone User-Agent strings paired with HTTP redirect chains that cross scheme or host boundaries
Alert on any S3 API access from source IPs or IAM identities that deviate from the baseline rclone client footprint
Correlate rclone process execution telemetry with outbound network flows to non-approved S3 endpoints

Monitoring Recommendations

Track versions of rclone deployed across the environment and flag hosts running versions earlier than v1.75.0
Monitor IBM Cloud Object Storage access logs for token reuse patterns from unexpected client IPs
Enable full request logging on S3 gateways so that SSE-C header presence and destination host can be reviewed

How to Mitigate CVE-2026-79780

Immediate Actions Required

Upgrade all rclone installations to v1.75.0 or later
Rotate any IBM IAM bearer tokens and SSE-C keys that may have been used with vulnerable rclone versions across untrusted networks
Restrict rclone execution to hosts on trusted network segments until the upgrade is complete

Patch Information

The fix is included in rclonev1.75.0, which sanitizes IBM IAM bearer tokens and SSE-C headers when a redirect changes the scheme or host. Review the GitHub Security Advisory GHSA-8mxv-9xhp-86h4 for the authoritative patch reference.

Workarounds

Enforce HTTPS-only endpoints for S3 and IBM Cloud Object Storage and block plaintext HTTP egress from rclone hosts
Pin rclone configurations to explicit endpoints and disable automatic redirect following where the backend supports it
Segment rclone clients onto networks where adjacent-network interception is not feasible

bash

# Verify installed rclone version and upgrade if below v1.75.0
rclone version

# Example endpoint pinning in rclone config to reduce redirect exposure
# [ibm-cos]
# type = s3
# provider = IBMCOS
# endpoint = https://s3.us-south.cloud-object-storage.appdomain.cloud
# no_check_bucket = true