Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

rclone before 1.75 exposes cloud credentials via redirects

published 2 months ago

Summary

Older versions of rclone can accidentally include IBM cloud access tokens and encryption keys in redirect URLs when working with S3 storage. If an attacker can watch the network traffic, they could capture those credentials and later access protected data. Upgrade rclone to version 1.75 or later to stop the credential leakage.

What to do

Update rclone github.com/rclone/rclone to version 1.75.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Go	rclone	github.com/rclone/rclone	< 1.75.0 Fix: upgrade to 1.75.0

Original advisory text

rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.0 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

CWE-319Cleartext Transmission of Sensitive Information

CWE-522Insufficiently Protected Credentials

Timeline

Published25 Aug 2026

Updated30 Sep 2026

First seen5 Aug 2026

Sources

GHSA-8mxv-9xhp-86h4 · OSV

Track software like this

Free during beta