CVE-2026-79780

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0

Description The software fails to sanitize IBM IAM bearer tokens and SSE-C (Server-Side Encryption with Customer-Provided Keys) encryption keys during S3 redirect callbacks. This allows credentials to be preserved when there are changes to the scheme or host. An attacker monitoring network traffic from a trusted endpoint can capture reusable IBM IAM tokens during same-host HTTPS-to-HTTP downgrades or capture SSE-C keys during cross-origin redirects to gain unauthorized access to protected S3 objects.

Recommendations Update rclone to version 1.75.0 or later.