CVE-2026-116190 in rclone
Summary
by MITRE • 10/25/2026
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in rclone versions from v1.56.0 up to but not including v1.75.2 represents a critical information disclosure flaw within its WebDAV backend implementation. This issue stems from an improper handling of HTTP redirect responses, specifically those returning status codes in the 3xx range such as 301 Moved Permanently or 302 Found. When rclone encounters these redirects during file operations against a remote storage service configured via the WebDAV protocol, it automatically follows the redirection to the new location without stripping sensitive authentication headers that were originally intended for the initial target host. This behavior is particularly dangerous because modern web architectures frequently utilize redirects for load balancing, content delivery network optimizations, or domain migrations, making this attack vector highly plausible in real-world deployments where administrators configure custom headers using flags like --webdav-headers to pass tokens such as X-Auth-Token for authentication purposes.
From a technical perspective, the flaw lies in the persistence of request context across different security boundaries without appropriate sanitization. When an operator configures rclone with specific HTTP headers containing credentials or session tokens, these are attached to every outgoing request under the assumption that they will only be processed by the intended destination server. However, when the initial server responds with a redirect pointing to a completely different host, potentially controlled by an attacker through DNS manipulation, malicious proxy configuration, or compromised infrastructure within the same network segment, rclone blindly forwards these headers to the new endpoint. This violates the principle of least privilege and fails to enforce strict origin-based isolation for sensitive metadata. The vulnerability allows any entity capable of influencing the redirect target to capture high-value authentication material that was never intended for their consumption, effectively bypassing access controls designed at the application layer by leveraging standard HTTP protocol mechanics.
The operational impact of this vulnerability is severe, primarily centering on unauthorized access and data exfiltration. An attacker who can manipulate or influence a cross-host redirect chain gains the ability to intercept sensitive headers such as X-Auth-Token, Authorization tokens, or other proprietary authentication mechanisms embedded in custom header configurations. Once captured, these credentials can be replayed against the original WebDAV service if the token is valid across multiple hosts or if the attacker has established a man-in-the-middle position relative to the legitimate service. This leads directly to unauthorized access to stored data, potential modification of files, and complete compromise of the integrity and confidentiality of the cloud storage environment managed by rclone. In enterprise environments where rclone is used for large-scale data synchronization across multiple providers or internal servers, this flaw could result in significant data breaches affecting sensitive corporate information, intellectual property, or personally identifiable information depending on the contents stored within the affected buckets or directories.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the software, the operating system, the network, or other values prior to a successful user login, although in this specific case it is more accurately categorized under CWE-524: Use of Cache for Sensitive Information if considering the persistence across redirects, but most precisely maps to CWE-319: Cleartext Transmission of Sensitive Information within an Unprotected Communication Channel when combined with network interception. Furthermore, from a tactical perspective in the MITRE ATT&CK framework, this behavior facilitates Credential Access via Network Sniffing or Intercepted Authentication Credentials (T1056) and potentially Account Manipulation if replay attacks lead to privilege escalation. The lack of strict host-bound header enforcement is a common oversight in HTTP client libraries that prioritize convenience over security context isolation during redirect handling.
To mitigate this risk, organizations must immediately upgrade rclone to version 1.75.2 or later, where the developers have addressed the logic error by ensuring that custom headers are not forwarded across different hosts unless explicitly configured otherwise through secure mechanisms. Until an upgrade is feasible, administrators should avoid using --webdav-headers for any sensitive authentication tokens when connecting to WebDAV servers known to perform redirects or reside in environments with untrusted network paths. Instead, they should rely on built-in authentication methods provided by the specific backend implementation that handle credentials more securely without exposing them as generic HTTP headers susceptible to redirect leakage. Additionally, implementing strict Content Security Policies and monitoring for unusual outbound traffic patterns involving WebDAV clients can help detect potential exploitation attempts in real-time while longer-term architectural changes are evaluated to ensure that credential handling adheres to modern security standards regarding origin isolation and header sanitization during protocol transitions.