Rclone EUVD-2026-109454

Exploitation requires that --b2-download-url be configured to a custom download host (a documented, vendor-recommended setup, e.g. pointing at a Cloudflare CDN) - it does NOT affect default Backblaze-download-host configurations. Vector 1 (Authorization token leak) additionally requires that custom host to issue a same-host HTTPS-to-HTTP downgrade redirect and an adjacent-network/on-path observer to capture the cleartext token. Vector 2 (SSE-C key leak) requires SSE-C to be configured and the download host to issue a cross-host redirect, which forwards the X-Bz-Server-Side-Encryption-Customer-* headers to the new host. The key limiting factors are: the redirect-downgrade/cross-host behavior is attacker-uncontrolled (it depends on the CDN/proxy misconfiguring redirects, reflected as AT:P), the attacker must hold an adjacent/on-path position (AV:A) for vector 1, and the vulnerable code path is only reached when the non-default --b2-download-url option is in use.

This is a moderate, conditional risk rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:H) scores 6.0 and tells a consistent story: no authentication is needed (PR:N) and no user interaction (UI:N), but exploitation is gated to an adjacent/on-path network position (AV:A), is high-complexity (AC:H), and depends on an attacker-uncontrolled precondition (AT:P) - namely that the configured download host actually issues an HTTPS-to-HTTP downgrade or cross-host redirect. The confidentiality impact is high and real (a live, full-capability B2 bearer token valid up to 24h, or SSE-C customer encryption keys), with no integrity or availability impact. No EPSS probability or CISA KEV status is present in the input, so there is no evidence of active or widespread exploitation; the GHSA advisory contains a conceptual proof-of-concept walkthrough but no confirmed working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the adjacent-vector, high-complexity, config-dependent profile. The one notable limiting factor is that the whole chain only fires when --b2-download-url is set (a documented, vendor-recommended CDN optimization) AND that fronting host misbehaves on redirects AND an attacker is positioned to observe the hop - so this is a genuine but narrow priority, not a high-CVSS-but-illusory issue.

An operator follows rclone's own documentation and sets --b2-download-url to a Cloudflare-fronted CDN for cheaper egress, then runs routine 'rclone copy' commands against their B2 bucket. If that CDN or proxy answers a download request with a same-host https-to-http downgrade redirect (a misconfiguration, a Worker rule, or an omitted scheme), Go's default client replays the live B2 Authorization token in cleartext, and an adjacent-network observer on that hop captures a full-capability account/application-key credential. The GHSA advisory documents a step-by-step conceptual PoC for this token-leak vector, but no verified working exploit code is indicated in the input.