CVE-2026-79782
Last modified
CVE-2026-79782 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| rclone | rclone | < 1.74.4 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-79782?
How severe is CVE-2026-79782?
How do I fix CVE-2026-79782?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-79777rclone before v1.75.0 includes full Go stack traces in RC AP…2.7
- CVE-2026-79778rclone before v1.75.0 contains a denial of service vulnerabi…5.3
- CVE-2026-79779rclone versions before v1.75.0 fail to reject transport down…5.3
- CVE-2026-7978Inappropriate implementation in Companion in Google Chrome o…8.1
- CVE-2026-79780rclone before v1.75.0 fails to sanitize IBM IAM bearer token…5.3
- CVE-2026-79781rclone serve s3 before 1.74.4 contains a path traversal vuln…6.5
- CVE-2026-79783rclone before 1.74.4 fails to mask special permission bits w…3.6
- CVE-2026-79784Vocos instantiates a class named by a configuration file wit…8.8
- CVE-2026-79785X-AnyLabeling's model downloader disabled TLS certificate ve…5.9
- CVE-2026-79786Coroot's unauthenticated MCP OAuth dynamic client registrati…7.1
- CVE-2026-79787Alluxio's S3 REST proxy fails to verify AWS Signature Versio…9.8
- CVE-2026-79788In Dradis Community Edition, the ProvidersController and Age…7.1
Are you affected by CVE-2026-79782?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST