{"id":"EUVD-2026-65538","enisaUuid":"61ca81a4-9521-3d19-b107-2f6992b55711","description":"rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.","datePublished":"Aug 25, 2026, 3:16:09 PM","dateUpdated":"Aug 25, 2026, 4:07:21 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4\nhttps://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect\n","aliases":"CVE-2026-79780\nGHSA-fj78-v5f5-cphq\n","assigner":"VulnCheck","epss":0.15,"enisaIdProduct":[{"id":"b63cd13a-8138-3d71-b7d6-5dd53fa33855","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"0 \u003c1.75.0"}],"enisaIdVendor":[{"id":"eca31a23-7e2f-3c7f-9e13-78693357dd64","vendor":{"name":"rclone"}}],"enisaIdVulnerability":[{"id":"6a2e52f4-e5d3-3fdb-9c34-d9adec7b6e80","vulnerability":{"id":"GHSA-fj78-v5f5-cphq","description":"rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.","datePublished":"Aug 25, 2026, 6:31:54 PM","dateUpdated":"Aug 25, 2026, 6:31:54 PM","baseScore":0.0,"references":"https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79780\nhttps://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect\n","enisa_id":"EUVD-2026-65538\n","aliases":"CVE-2026-79780\nGHSA-fj78-v5f5-cphq\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c94e543d-87a8-3221-a8b1-2a0a7107cecc","vulnerability":{"id":"CVE-2026-79780","description":"rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.","datePublished":"Aug 25, 2026, 3:16:09 PM","dateUpdated":"Aug 25, 2026, 4:07:21 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4\nhttps://www.vulncheck.com/advisories/rclone-before-credential-exposure-via-s3-redirect\n","enisa_id":"EUVD-2026-65538\n","assigner":"VulnCheck","epss":0.15,"dataProcessed":"Nov 11, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"555492b3-7135-3a78-b16e-29ab9681d303","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"0 \u003c1.75.0"}],"vulnerabilityVendor":[{"id":"1af610bc-4c37-30bf-9ac9-699bf7162179","vendor":{"name":"rclone"}}]}}],"enisaIdAdvisory":[]}