rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
## Vulnerability Details **File**: `backend/s3/s3.go` **Lines**: 1359-1380 (functions `s3CheckRedirect` / `s3RedirectCrossesHost`) ### Root Cause Commit `e7b1eb774` (released in v1.74.3) added a `CheckRedirect` policy for the S3 HTTP client whose purpose is to strip the `X-Amz-Security-Token` header (the AWS STS session token) whenever a redirect chain "crosses a host", so the token isn't forwarded to an unintended origin. `s3RedirectCrossesHost` decides this purely by comparing `url.URL.Host` (hostname[:port]); it never looks at `url.URL.Scheme`. A redirect that keeps the exact same host:port but changes the scheme from `https://` to `http://` therefore compares as "same host" and `X-Amz-Security-Token` is *not* stripped — it is sent again, this time over plaintext HTTP. ```go func s3RedirectCrossesHost(req *http.Request, via []*http.Request) bool { if len(via) == 0 { return false } host := via[0].URL.Host for _, redirect := range via[1:] { if redirect.URL.Host != host { return true } } return host != req.URL.Host } ``` ### Attack Scenario 1. The user configures an `s3` remote (or `--s3-endpoint` pointing at a self-hosted/third-party S3-compatible service) using temporary credentials that include an STS `session_token` (common for assumed-role / CI / Kubernetes IRSA setups). 2. The configured endpoint responds to a request with a 3xx redirect to the *same* host:port but with `http://` instead of `https://` (TLS-front misconfiguration, maintenance redirect, or a malicious/com
GHSA-gx4c-2hqx-cw2r
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-gx4c-2hqx-cw2r
github.com/rclone/rclone
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.74.4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.74.4"
}
]
}
],
"package": {
"name": "github.com/rclone/rclone",
"purl": "pkg:golang/github.com/rclone/rclone",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gx4c-2hqx-cw2r/GHSA-gx4c-2hqx-cw2r.json",
"last_known_affected_version_range": "<= 1.74.3"
}
}
]- Related CVEs
- CVE-2026-79782
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #15281 · Revision 1
- Added to Heist Feed
- Publisher date
GO-2026-6196
Revision 1
S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone
S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6196
github.com/rclone/rclone
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.74.4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.74.4"
}
]
}
],
"package": {
"name": "github.com/rclone/rclone",
"purl": "pkg:golang/github.com/rclone/rclone",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6196.json"
},
"ecosystem_specific": {
"imports": [
{
"path": "github.com/rclone/rclone/backend/s3"
}
]
}
}
]- Related CVEs
- CVE-2026-79782
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #15283 · Revision 1
- Added to Heist Feed
- Publisher date