CVE-2026-79782 json
rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
published 2026-08-05 3 mo ago modified 2026-09-25 45 d ago also BIT-rclone-2026-79782 , EUVD-2026-65540 , GHSA-gx4c-2hqx-cw2r , GO-2026-6196
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.
Patch / fix
- go github.com/rclone/rclone 1.74.4
- bitnami rclone 1.74.4
- rclone rclone 1.74.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/rclone/rclone | <1.74.4 |
1.74.4 |
| bitnami | rclone | <1.74.4 |
1.74.4 |
Affected products
- rclone rclone
Classification
References
-
github.com
/rclone/rclone/commit/1a28451ea6fc8ac1806b0e9923dcb5b3f543f7fa
web, patch
-
github.com
/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect
third-party-advisory, web
-
github.com
/rclone/rclone
package
-
github.com
/rclone/rclone/releases/tag/v1.74.4
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-79782
web
Sources
- CVE List CVE-2026-79782
- GitHub Advisory GHSA-gx4c-2hqx-cw2r
- NVD CVE-2026-79782
- OSV BIT-rclone-2026-79782
- OSV GO-2026-6196
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.