rclone (S3 backend, redirect sanitization): When rclone's S3 backend follows a redirect it strips some sensitive

Impact

When rclone's S3 backend follows a redirect it strips some sensitive headers but not IBM IAM bearer tokens or SSE-C customer-supplied encryption keys. An attacker who can steer a redirect harvests the bearer token, and the SSE-C key is the thing standing between them and the plaintext of the encrypted objects - so this leaks both the credential and the key material for a dataset store in one shot.

Who can reach it

An attacker positioned to influence the HTTP redirect chain between rclone and the object store - a hostile or compromised endpoint, or a network position on the cluster's egress path.

What to do

Upgrade rclone to the fixed release. Rotate any IBM IAM credentials and SSE-C keys that were used with a redirecting endpoint. Pin the S3 endpoint and disable redirect following where your object store does not need it. No CVE ID has been assigned; track it by the GHSA.

References