rclone EUVD-2026-65538

Exploitation requires three concurrent conditions: (1) the rclone client must be performing S3 operations using IBM IAM bearer token authentication or SSE-C customer-provided encryption keys - rclone deployments using only standard AWS SigV4 with STS tokens are not affected by the IBM IAM or SSE-C paths; (2) a trusted S3-compatible endpoint, gateway, or accelerator in the request path must issue an unsafe HTTP redirect - specifically, either a same-hostname HTTPS-to-HTTP scheme downgrade (for the IBM IAM token path) or a cross-origin redirect to a different hostname (for the SSE-C key path) - this is outside the attacker's direct control unless the gateway itself is compromised or misconfigured; (3) the attacker must hold a network-adjacent position capable of observing the plaintext HTTP traffic on the downgraded leg or the redirected request to the cross-origin host. Limiting factors: the adjacent network requirement (AV:A) rules out remote internet attackers; the high attack complexity (AC:H) requires the specific redirect behavior to be present; unauthenticated attackers on isolated VPC segments with no path adjacency cannot exploit this. Standard AWS STS token flows are separately handled by the existing X-Amz-Security-Token stripping logic and are not affected.

The CVSS 4.0 score of 6.0 reflects meaningful but constrained real-world risk. The AV:A (Adjacent) metric is the primary limiter: the attacker must occupy a network-adjacent position relative to the rclone client, such as a shared cloud subnet, a compromised gateway, or an on-path BGP-adjacent network segment. AC:H and AT:P further indicate that exploitation requires a specific, non-default redirect behavior from a trusted S3-compatible endpoint - the endpoint itself must emit an unsafe redirect (scheme downgrade or cross-origin), a condition outside the attacker's direct control. Despite these constraints, VC:H is justified because IBM IAM bearer tokens are reusable credentials, meaning their capture translates directly into persistent unauthorized access to IBM Cloud Object Storage resources, not merely a one-time session token. The EPSS score is not provided in the input data, so exploitation probability cannot be quantified independently. The vulnerability is not in CISA KEV, and no standalone exploit tool is publicly available beyond the PoC steps in the GHSA advisory. For organizations operating rclone against IBM Cloud Object Storage or using SSE-C encryption, this warrants prompt patching since a single compromised upstream gateway could expose long-lived IAM credentials; for operators not using IBM IAM backends or SSE-C, practical exposure is negligible. The 6.0 base score is proportionate: the adjacent vector and high complexity meaningfully reduce exploitability relative to the high confidentiality impact.

A network-adjacent attacker positioned on the same subnet or acting as an on-path gateway between a rclone client and an S3-compatible endpoint configures or exploits a trusted gateway to issue an HTTPS-to-HTTP redirect on the same hostname for S3 GET requests. When rclone follows the redirect, Go's HTTP client retains the Authorization: Bearer header (IBM IAM token) because the hostname did not change, and rclone's callback does not strip it; the attacker captures the plaintext IBM IAM token from the downgraded HTTP leg and subsequently uses it to make authenticated requests directly to IBM Cloud Object Storage. A proof-of-concept demonstrating both the same-host scheme-downgrade path and the cross-origin SSE-C key disclosure path is documented in GHSA-8mxv-9xhp-86h4.