{"uuid": "4177fa33-fa81-4c8b-8834-0f690bdbbd8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8mxv-9xhp-86h4", "type": "seen", "source": "https://gist.github.com/alon710/719fff48bd5faded3e0e79faaf3782f6", "content": "# GHSA-8MXV-9XHP-86H4: GHSA-8MXV-9XHP-86H4: Information Disclosure and Credential Leakage during S3 HTTP Redirects in rclone\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/GHSA-8MXV-9XHP-86H4\n\n## Summary\nA critical security flaw was identified in rclone before version 1.75.0, where the custom S3 redirect handler failed to sanitize sensitive authentication headers and encryption keys during cross-host redirects or transport downgrades. This flaw allows attackers on the path or controlling target hosts to intercept sensitive IBM IAM tokens, AWS S3 Express tokens, and customer-provided server-side encryption keys (SSE-C).\n\n## TL;DR\nRclone versions prior to 1.75.0 leak sensitive authentication headers and SSE-C customer-provided encryption keys during protocol downgrades and cross-host HTTP redirects.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200 / CWE-201\n- **Attack Vector**: Adjacent Network\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC / Conceptual\n- **Affected Component**: S3 backend (s3CheckRedirect)\n- **Fixed Version**: v1.75.0\n\n## Affected Systems\n\n- rclone S3 Backend\n- **github.com/rclone/rclone**: < 1.75.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone to 1.75.0 or later to ensure proper redirect scrubbing.\n- Enforce HTTPS transit across all cloud storage remote profiles.\n- Block outgoing port 80 traffic for administrative processes running rclone.\n\n**Remediation Steps:**\n1. Verify the current version of rclone utilizing 'rclone version'.\n2. Download and deploy version 1.75.0 or newer from the official repository.\n3. Update existing cloud configuration profiles to use secure HTTPS endpoints.\n4. In critical paths, rotate temporary AWS STS credentials, S3 Express directory bucket tokens, and SSE-C keys.\n\n## References\n\n- [GitHub Security Advisory GHSA-8MXV-9XHP-86H4](https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4)\n- [rclone v1.75.0 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8MXV-9XHP-86H4) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T13:32:14.085238Z"}