Listen to this Post
How CVE-2026-41179 Works
The vulnerability resides in the S3 backend of rclone, a command-line program for syncing files with cloud storage providers. Specifically, the flaw is in the `s3RedirectCrossesHost` function within backend/s3/s3.go.
The root cause is an incomplete implementation of a security policy introduced in commit `e7b1eb774` (released in v1.74.3). This policy was designed to strip the `X-Amz-Security-Token` header—which contains the AWS STS session token—from HTTP requests whenever a redirect chain “crosses a host”. The goal was to prevent the token from being forwarded to an unintended origin.
The flaw arises because the `s3RedirectCrossesHost` function determines if a redirect “crosses a host” solely by comparing the `url.URL.Host` (hostname and port). It completely ignores the `url.URL.Scheme` (the protocol, e.g., `https` or http).
Consequently, if a redirect changes the scheme from `https://` to `http://` but keeps the exact same host and port, the function incorrectly treats it as a “same host” redirect. The `X-Amz-Security-Token` is not stripped and is resent over the now-unencrypted plaintext HTTP connection.
Attack Scenario:
- A user configures an `s3` remote or uses the `–s3-endpoint` flag to point to a self-hosted or third-party S3-compatible service.
- They use temporary credentials that include an STS
session_token, common in assumed-role, CI, or Kubernetes IRSA setups. - The configured endpoint responds to a request with a 3xx redirect to the same `host:port` but with
http://` instead ofhttps://`. - rclone’s S3 HTTP client follows the redirect and re-sends the request, including the
X-Amz-Security-Token, over the unencrypted connection. - Any passive observer on that network path can read the STS session token from the request headers.
DailyCVE Form:
Platform: rclone
Version: <= 1.74.3
Vulnerability: Cleartext token leak
Severity: Low
date: 2026-08-05
Prediction: 2026-06-05
Analytics under Heading What Undercode Say:
Verify the vulnerable code in backend/s3/s3.go grep -A 10 "func s3RedirectCrossesHost" backend/s3/s3.go
// Vulnerable code: Only compares Host, not Scheme
func s3RedirectCrossesHost(req http.Request, via []http.Request) bool {
if len(via) == 0 {
return false
}
host := via[bash].URL.Host
for _, redirect := range via[1:] {
if redirect.URL.Host != host {
return true
}
}
return host != req.URL.Host
}
Exploit:
An attacker can exploit this vulnerability by controlling or compromising an S3-compatible endpoint that the rclone client is configured to use. The attacker needs to make the endpoint respond with a 301, 302, or `307` redirect to the same `host:port` but downgrading the scheme from https://` tohttp://`. When rclone follows this redirect, the STS session token is transmitted in cleartext over the network. A passive attacker on the network path can then capture this token.
Protection:
The primary protection against this CVE is to upgrade to a patched version of rclone. The vulnerability is fixed in versions 1.74.4 and 1.75.0. The fix involves modifying the `s3RedirectCrossesHost` function to also compare the URL.Scheme, ensuring that any scheme downgrade is treated as a host change and triggers the stripping of sensitive headers.
Impact:
Successful exploitation leads to the disclosure of the AWS STS session token (X-Amz-Security-Token) in cleartext. The impact is limited to the token’s validity window and the permissions associated with the STS session. An attacker who captures this token can impersonate the user and perform any actions within the scope of the assumed role for the remainder of the token’s lifetime.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
