Homepage

Insufficiently Protected Credentials Affecting github.com/rclone/rclone/backend/s3 package, versions <1.74.4

Severity

 Recommended
0.0
low
0
10

CVSS assessment by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMRCLONERCLONEBACKENDS3-20158612
  • published27 Sept 2026
  • disclosed5 Aug 2026
  • creditUnknown
Report a new vulnerability Found a mistake?

Introduced: 5 Aug 2026

CVE NOT AVAILABLE CWE-319  (opens in a new tab)
CWE-522  (opens in a new tab)

How to fix?

Upgrade github.com/rclone/rclone/backend/s3 to version 1.74.4 or higher.

Overview

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the s3CheckRedirect process. An attacker can intercept sensitive session tokens by inducing a redirect from HTTPS to HTTP on the same host, causing the token to be sent over an unencrypted connection.

CVSS Base Scores

version 4.0
version 3.1