CVE-2026-79780

MediumCVSS 5.3/10Last modified Sep 10, 2026

Description

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-797816.5rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using CVE-2026-797823.1rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. CVE-2026-797833.6rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attack CVE-2026-797848.8Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained CVE-2026-797855.9X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py b CVE-2026-797867.1Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, all CVE-2026-797879.8Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers CVE-2026-797887.1In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`CVE-2026-79794.3Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a craf CVE-2026-797925.6A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anythin CVE-2026-797934.3A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-797949.1A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker