---
id: CVE-2026-79782
title: >-
  rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3
  redirect changes scheme from HTTPS to HTTP on the same host
summary: >-
  rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3
  redirect changes scheme from HTTPS to HTTP on the same host. Attackers can
  intercept plaintext HTTP traffic to capture AWS STS session tokens sent in
  request …
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-319
vendor: rclone
product: github.com/rclone/rclone
affected:
  - github.com/rclone/rclone < 1.74.4
patched:
  - github.com/rclone/rclone 1.74.4
published: '2026-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:46:19.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79782'
references:
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rclone-before-security-token-disclosure-via-https-to-http-redirect
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/rclone/rclone/commit/1a28451ea6fc8ac1806b0e9923dcb5b3f543f7fa
  - url: 'https://github.com/rclone/rclone'
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.74.4'
tags:
  - nvd
  - osv
  - go
epss: 0.0023
epssPercentile: 0.12253
aliases:
  - GHSA-gx4c-2hqx-cw2r
  - GO-2026-6196
ecosystem: go
ingestedAt: '2026-08-27T19:27:46.988Z'
---

## Overview

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79782)

Affected packages:

- `github.com/rclone/rclone < 1.74.4`

Patched in:

- `github.com/rclone/rclone 1.74.4`

Source: https://osv.dev/vulnerability/GHSA-gx4c-2hqx-cw2r