CVE-2026-116194 in Rclone
Summary
by MITRE • 10/25/2026
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Rclone versions ranging from 1.52.0 up to but not including 1.75.2 represents a critical security flaw within the pCloud backend implementation, specifically targeting the local OAuth callback mechanism used for authentication. This issue stems from an improper validation of state parameters and hostname inputs during the authorization flow. In standard OAuth implementations, the state parameter is essential for preventing cross-site request forgery attacks by ensuring that the response corresponds to a specific client-initiated request. However, in this affected version of Rclone, the localhost callback handler disables or bypasses the strict checking of the state token when processing requests directed at the local loopback interface on port 53682. This design choice was likely intended to facilitate easier testing and usage for users running Rclone locally without a complex DNS setup, but it inadvertently creates a significant security gap that can be exploited by malicious actors operating within the same network environment or through social engineering techniques involving web browsers.
The technical core of this vulnerability lies in the trust placed in the hostname parameter provided during the OAuth callback process. Because the state check is disabled for localhost callbacks, an attacker who can induce a user to load a malicious webpage while authenticated with Rclone can craft a forged request that targets the local authentication endpoint. By manipulating the parameters sent back from pCloud's authorization server or by intercepting and modifying the flow, the attacker can inject arbitrary values into the hostname field. This allows the attacker to plant their own OAuth tokens and configure API host endpoints within the user's session context. Consequently, when the user subsequently initiates file transfers using Rclone with access to sensitive data stored in pCloud, these operations are redirected or authenticated using credentials controlled by the attacker rather than the legitimate service infrastructure.
The operational impact of this vulnerability is severe, as it effectively compromises the integrity and confidentiality of cloud storage interactions managed by Rclone. An successful exploitation allows an adversary to gain unauthorized access to a user's pCloud account data without needing their password or multi-factor authentication credentials directly. Once the attacker has planted valid tokens and configured malicious API hosts, they can exfiltrate files, modify existing content, or delete data at will. This scenario is particularly dangerous because it leverages the trust relationship between the local application and its backend service, turning a convenience feature into an attack vector for account takeover and data theft. The risk is amplified in shared computing environments where multiple users might be logged into Rclone simultaneously, allowing one user to potentially compromise another's session if they can trigger the malicious callback sequence.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), as it involves tricking a authenticated user into performing an action that alters their security context without their explicit consent for that specific change in authentication parameters. Furthermore, from a tactical perspective related to the MITRE ATT&CK framework, this exploit maps to techniques involving credential access and data exfiltration via cloud storage services. The attacker utilizes valid credentials obtained through the forged callback to maintain persistence or perform lateral movement within the user's digital assets. To mitigate this risk, users are strongly advised to upgrade Rclone immediately to version 1.75.2 or later, where these checks have been reinforced. Additionally, administrators should ensure that local OAuth callbacks are only used in trusted environments and consider implementing additional network-level controls such as firewall rules to restrict access to the localhost authentication port from untrusted sources until all systems within an organization can be updated to patched versions.