CVE-2026-88013 in rclone
Summary
by MITRE • 09/10/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in rclone versions from 1.49.0 through 1.75.1 represents a critical information disclosure flaw rooted in improper handling of HTTP redirects and header propagation within the application's backend implementation. Rclone is widely utilized for synchronizing data across various cloud storage providers, often involving sensitive operational credentials and authentication tokens. The core technical deficiency lies in how the http.Client instance manages redirection policies when interacting with remote servers configured via command-line flags or configuration files. Specifically, while custom headers such as X-Api-Key are attached to outgoing requests based on user-defined configurations, the underlying HTTP client does not enforce a strict CheckRedirect policy that would filter or strip these sensitive headers during redirect events. This architectural oversight allows for two distinct attack vectors depending on the nature of the redirection triggered by the target server.
In scenarios where a configured remote redirects traffic to an entirely different host domain, the vulnerability enables cross-domain leakage of authentication secrets. When rclone follows such a redirect without restriction, it automatically appends all previously set custom headers to the new request directed at the untrusted third-party destination. This behavior effectively bypasses standard browser-like same-origin policies that typically protect against unauthorized data exfiltration in web contexts but are not inherently enforced by default HTTP client implementations used in command-line tools. Consequently, an attacker controlling a malicious cloud storage endpoint or compromising a legitimate one could configure it to redirect requests to their own server, thereby capturing sensitive API keys and other confidential header values sent during normal operations such as listing directories, stat-ing files, downloading content, mounting drives, or serving data.
A second vector involves same-host redirects that transition from HTTPS to HTTP protocols. In this case, the vulnerability leads to the exposure of credentials in cleartext over an unencrypted channel. Even if the initial request is made securely via HTTPS, a redirect back to the same host but using plain HTTP causes headers containing sensitive information like Authorization tokens or Cookie values to be transmitted without encryption. This exposes these secrets to potential interception by network-level attackers capable of monitoring traffic on the path between the client and the server. The impact extends beyond mere credential theft; it can lead to unauthorized access, data breaches, and compromise of entire cloud storage ecosystems linked through those credentials.
This flaw aligns with CWE-201: Information Exposure Through Sent Data, as it involves the unintended transmission of sensitive information to an incorrect recipient or over an insecure channel due to a failure in input validation or state management regarding redirect handling. From a tactical perspective within the MITRE ATT&CK framework, this vulnerability facilitates Credential Access via Network Sniffing and potentially Account Manipulation if stolen credentials are used for lateral movement or privilege escalation within connected cloud environments. The risk is exacerbated by the fact that listing, statting, downloading, mounting, and serving operations can all trigger these redirects during routine usage, making exploitation straightforward and likely to occur in standard operational workflows without requiring specialized attack conditions beyond controlling a redirecting endpoint.
Mitigation for this vulnerability requires immediate upgrading of rclone to version 1.75.1 or later, where the issue has been resolved by implementing stricter header filtering logic during redirection events. Organizations relying on older versions should implement network-level controls such as firewall rules that block outbound connections to untrusted domains from systems running vulnerable instances, although this is a less robust defense than patching the software itself. Additionally, administrators should audit their rclone configurations to ensure that sensitive headers are not unnecessarily included in requests unless strictly required for specific operations, thereby reducing the blast radius if similar vulnerabilities arise in future versions. Continuous monitoring of outbound traffic patterns can also help detect anomalous connections indicative of exploitation attempts targeting this header leakage behavior.