CVE-2026-79782

critical · 9.3

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

9.3

CVSS

0.1%

EPSS (exploit prob.)

3rd

EPSS percentile

2026-08-25

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-319

References

https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r
https://www.vulncheck.com/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-79782