BIT-rclone-2026-116190

    Dashboard / Vulnerabilities / BIT-rclone-2026-116190

    BIT-rclone-2026-116190

    Published: 29 Oct 2026Last Modified: 30 Oct 2026

    Summary: rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

    Details: rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.

    References: https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v, https://nvd.nist.gov/vuln/detail/CVE-2026-116190, https://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect

    Affected packages

    Package

    Name: rclone

    Purl: pkg:bitnami/rclone

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 1.56.0
    Fixed -1.75.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-rclone-2026-116190 | CVE-DB