DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-8MXV-9XHP-86H4: GHSA-8MXV-9XHP-86H4: Information Disclosure and Credential Leakage during S3 HTTP Redirects in rclone

#security #cve #cybersecurity #ghsa

GHSA-8MXV-9XHP-86H4: Information Disclosure and Credential Leakage during S3 HTTP Redirects in rclone

Vulnerability ID: GHSA-8MXV-9XHP-86H4
CVSS Score: 5.3
Published: 2026-08-05

A critical security flaw was identified in rclone before version 1.75.0, where the custom S3 redirect handler failed to sanitize sensitive authentication headers and encryption keys during cross-host redirects or transport downgrades. This flaw allows attackers on the path or controlling target hosts to intercept sensitive IBM IAM tokens, AWS S3 Express tokens, and customer-provided server-side encryption keys (SSE-C).

TL;DR

Rclone versions prior to 1.75.0 leak sensitive authentication headers and SSE-C customer-provided encryption keys during protocol downgrades and cross-host HTTP redirects.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200 / CWE-201
  • Attack Vector: Adjacent Network
  • CVSS Score: 5.3 (Medium)
  • Exploit Status: PoC / Conceptual
  • Affected Component: S3 backend (s3CheckRedirect)
  • Fixed Version: v1.75.0

Affected Systems

  • rclone S3 Backend
  • github.com/rclone/rclone: < 1.75.0 (Fixed in: 1.75.0)

Code Analysis

Commit: 9328763

Address S3 redirects, scheme downgrades, and SSE-C key leakage

Commit: 7543a7a

Incorporate S3 Express session token cleanup and redirect validation tests

Mitigation Strategies

  • Upgrade rclone to 1.75.0 or later to ensure proper redirect scrubbing.
  • Enforce HTTPS transit across all cloud storage remote profiles.
  • Block outgoing port 80 traffic for administrative processes running rclone.

Remediation Steps:

  1. Verify the current version of rclone utilizing 'rclone version'.
  2. Download and deploy version 1.75.0 or newer from the official repository.
  3. Update existing cloud configuration profiles to use secure HTTPS endpoints.
  4. In critical paths, rotate temporary AWS STS credentials, S3 Express directory bucket tokens, and SSE-C keys.

References

Read the full report for GHSA-8MXV-9XHP-86H4 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)