CVE-2026-79782CWE-319

CVE-2026-79782

Low · published August 25, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00132 · 2.5th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-08-25T20:17Z
References (2)
https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r · [email protected]https://www.vulncheck.com/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:16Z
    rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
    cvelistv5