rclone EUVD-2026-65540

Requires the rclone S3 backend to be configured with temporary AWS credentials that include an STS session_token (assumed-role, CI, or Kubernetes IRSA setups), AND the configured S3 endpoint (via s3 remote or --s3-endpoint) to respond with a 3xx redirect to the same host:port that downgrades the scheme from https:// to http://, AND a passive attacker positioned on the resulting plaintext network path to read request headers. Limiting factors: it does not fire against endpoints that never redirect to HTTP (e.g. correctly configured AWS S3), it does not apply when static long-lived credentials without a session token are used, the leaked token is only useful within its validity window, and versions before 1.74.3 lacked the redirect-stripping feature entirely so this specific same-host/scheme-downgrade gap is a regression scoped to 1.74.3.

The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) rates this Critical with high impact across confidentiality, integrity, and availability, but that appears aggressive relative to the described mechanism: the primary, directly-caused effect is disclosure of an STS session token (a confidentiality loss), while integrity/availability impact is only indirect and contingent on what the captured token can subsequently do. Exploitation also is not truly condition-free - it requires the configured S3 endpoint to issue a same-host scheme-downgrade redirect (a TLS-front misconfiguration, maintenance redirect, or a malicious/compromised S3-compatible provider) AND an attacker positioned to read the plaintext path - which argues for higher attack complexity than AC:L/AT:N implies. There is no EPSS score, no KEV listing, and no POC provided, so real-world exploitation signal is currently absent and the practical risk is best described as targeted/opportunistic rather than mass-exploitable. That said, temporary credentials are common in CI, assumed-role, and Kubernetes IRSA workflows, and a captured token is immediately usable within its validity window, so operators relying on third-party or self-hosted S3-compatible endpoints should treat this as a prompt patching priority.

An operator configures an rclone S3 remote against a self-hosted or third-party S3-compatible endpoint using assumed-role temporary credentials, so requests carry an X-Amz-Security-Token header. The endpoint (compromised, or misconfigured behind a TLS front) answers a request with a 3xx redirect to the identical host:port over http:// instead of https://; rclone treats it as 'same host,' follows it, and re-sends the STS token in cleartext, where a passive on-path observer captures it and reuses it until it expires. No public POC is available, and the described attack vector is network-based but hinges on the specific redirect and an interception position rather than a simple one-shot request.