CVE-2026-79782

Name	CVE-2026-79782
Description	rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145670

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rclone (PTS)	bullseye	1.53.3-1	vulnerable
	bookworm	1.60.1+dfsg-2	vulnerable
	trixie	1.60.1+dfsg-4	vulnerable
	sid	1.69.3+dfsg-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rclone	source	(unstable)	(unfixed)			1145670

https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r