CVE-2026-79780 rclone CVE debrief

Who should care

Defenders responsible for rclone configurations and S3 security should assess exposure and verify versions. They should prioritize verifying rclone versions and configurations, especially for same-host HTTPS-to-HTTP downgrades or cross-origin redirects, to prevent potential credential exposure and unauthorized S3 access. Security teams and operators managing rclone deployments should review configurations and ensure proper versioning to mitigate risks.

Why it matters

Defenders should prioritize verifying rclone versions and configurations to prevent potential credential exposure and unauthorized S3 access.

• Potential credential exposure via S3 redirect callbacks
• Possible unauthorized access to protected S3 objects

Technical summary

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects. This issue enables potential credential exposure via S3 redirect callbacks and possible unauthorized access to protected S3 objects. Defenders should prioritize verifying rclone versions and configurations.

Defensive priority

Defenders should prioritize verifying rclone versions and configurations, especially for same-host HTTPS-to-HTTP downgrades or cross-origin redirects.

Recommended defensive actions

• Verify rclone version and upgrade to v1.75.0 or later if necessary
• Review configurations for same-host HTTPS-to-HTTP downgrades or cross-origin redirects
• Monitor for suspicious S3 access patterns
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description notes that rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks. This behavior allows credentials to be preserved across scheme or host changes, potentially exposing credentials via S3 redirect callbacks and possibly leading to unauthorized access to protected S3 objects. Defenders should verify rclone versions and review configurations, especially for same-host HTTPS-to-HTTP downgrades or cross-origin redirects, to prevent potential credential capture

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.