CVE-2026-79782: rclone S3 Token Exposure Vulnerability

CVE-2026-79782 Overview

CVE-2026-79782 is a cleartext transmission vulnerability [CWE-319] in rclone versions before 1.74.4. The tool fails to strip the X-Amz-Security-Token header when an Amazon Simple Storage Service (S3) redirect downgrades the scheme from HTTPS to HTTP on the same host. Attackers positioned to observe network traffic can intercept the plaintext HTTP request and capture Amazon Web Services (AWS) Security Token Service (STS) session tokens. Captured tokens grant the attacker the same access rights as the originating rclone session, enabling unauthorized operations against AWS resources.

Critical Impact
Adversaries capable of intercepting network traffic can steal AWS STS session tokens and impersonate rclone users against S3-compatible services.

Affected Products

rclone versions prior to 1.74.4
Deployments using AWS STS session credentials with S3 or S3-compatible endpoints
Environments where rclone follows redirects across HTTPS-to-HTTP scheme changes

Discovery Timeline

2026-08-25 - CVE-2026-79782 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79782

Vulnerability Analysis

rclone is a command-line program for managing files across cloud storage providers, including AWS S3. When rclone authenticates to S3 using temporary credentials issued by AWS STS, it attaches the session token to each request through the X-Amz-Security-Token HTTP header. The client must transmit this header exclusively over TLS-protected channels because it functions as a bearer credential.

The defect resides in rclone's redirect handling. When an S3 endpoint responds with a redirect that changes the URL scheme from https:// to http:// while keeping the same host, rclone follows the redirect and re-sends the original request headers, including X-Amz-Security-Token. The header travels over unencrypted HTTP, exposing the STS session token to any observer on the network path.

An attacker who captures the token can call AWS APIs as the compromised principal until the token expires. Depending on the associated Identity and Access Management (IAM) policy, this may include reading, writing, or deleting objects in S3 buckets and pivoting to other AWS services.

Root Cause

The root cause is missing sensitive-header stripping on scheme downgrade during HTTP redirect processing. Secure HTTP clients typically drop authentication and authorization headers when a redirect crosses a security boundary such as a different host or a downgrade from HTTPS to HTTP. rclone's redirect logic evaluated the host but not the scheme, so it preserved the X-Amz-Security-Token header across the downgrade.

Attack Vector

Exploitation requires an attacker positioned to influence redirect responses or observe traffic between the rclone client and the S3 endpoint. Common scenarios include a malicious or compromised S3-compatible service returning a crafted HTTP 3xx redirect, an on-path adversary tampering with responses, or a poisoned DNS response that steers traffic to an attacker-controlled endpoint that issues the downgrade redirect. Once rclone follows the redirect, the attacker captures the plaintext token from the wire and replays it against AWS STS-authenticated APIs.

Refer to the GitHub Security Advisory GHSA-gx4c-2hqx-cw2r and the VulnCheck advisory on rclone for additional technical context.

Detection Methods for CVE-2026-79782

Indicators of Compromise

Outbound HTTP (port 80) traffic from hosts running rclone toward S3 or S3-compatible endpoints
HTTP 301, 302, 307, or 308 responses from S3 endpoints that rewrite https:// targets to http://
Presence of the X-Amz-Security-Token header in cleartext HTTP requests captured by network sensors
AWS CloudTrail entries showing STS session credentials used from unexpected source IP addresses or user agents

Detection Strategies

Inspect proxy and network telemetry for rclone user agents making plaintext HTTP requests to S3-compatible hosts.
Correlate CloudTrail AssumeRole events with subsequent API activity from geographically or behaviorally anomalous source IPs.
Enumerate rclone binaries across managed hosts and flag any build older than 1.74.4.

Monitoring Recommendations

Alert on any HTTP request containing the X-Amz-Security-Token header traversing egress points.
Baseline expected S3 endpoints per environment and alert on redirects to unknown hosts or non-TLS schemes.
Continuously audit IAM policies attached to rclone service principals to limit blast radius if a token is stolen.

How to Mitigate CVE-2026-79782

Immediate Actions Required

Upgrade all rclone installations to version 1.74.4 or later across servers, workstations, containers, and CI/CD runners.
Rotate any AWS STS session credentials and long-lived keys that may have been used by vulnerable rclone clients.
Restrict egress firewall rules so rclone hosts can reach S3 endpoints only over TCP port 443.

Patch Information

The rclone maintainers addressed the issue in version 1.74.4 by stripping the X-Amz-Security-Token header on redirects that downgrade the scheme from HTTPS to HTTP. Consult the GitHub Security Advisory GHSA-gx4c-2hqx-cw2r for the fix commit and release notes.

Workarounds

Block outbound HTTP (port 80) traffic from systems that run rclone, forcing all S3 communication over TLS.
Use IAM roles with the shortest viable session duration and scope permissions to the minimum required buckets and actions.
Prefer S3 endpoints that reject plaintext HTTP and enforce HTTPS-only bucket policies with aws:SecureTransport conditions.

bash

# Configuration example: enforce TLS-only S3 access via bucket policy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::example-bucket",
        "arn:aws:s3:::example-bucket/*"
      ],
      "Condition": {
        "Bool": { "aws:SecureTransport": "false" }
      }
    }
  ]
}