Bug 2531804

Summary:	CVE-2026-88013 rclone: rclone: Information disclosure via HTTP backend forwarding headers on redirect [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Matteo Signorini <msignori>
Component:	rclone	Assignee:	Mikel Olasagasti Uranga <mikel>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	epel10	CC:	go-sig, mikel
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["84ff0938-312b-4792-bf59-0aecbbb03177"]}
Fixed In Version:	rclone-1.75.2-1.el10_3 rclone-1.75.2-1.el10_4 rclone-1.75.2-2.el9 rclone-1.75.2-1.el10_2	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-21 00:42:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2531530

Description Matteo Signorini 2026-09-11 09:27:06 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

Comment 1 Fedora Update System 2026-10-11 11:35:54 UTC

FEDORA-EPEL-2026-954982c495 (rclone-1.75.2-2.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-954982c495

Comment 2 Fedora Update System 2026-10-13 01:28:00 UTC

FEDORA-EPEL-2026-7f7663646b has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7f7663646b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2026-10-13 01:51:25 UTC

FEDORA-EPEL-2026-17f3815271 has been pushed to the Fedora EPEL 10.3 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-17f3815271

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-10-13 02:17:21 UTC

FEDORA-EPEL-2026-f9baf30320 has been pushed to the Fedora EPEL 10.4 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f9baf30320

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-13 02:31:16 UTC

FEDORA-EPEL-2026-954982c495 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-954982c495

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-10-21 00:42:09 UTC

FEDORA-EPEL-2026-17f3815271 (rclone-1.75.2-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2026-10-21 00:59:09 UTC

FEDORA-EPEL-2026-f9baf30320 (rclone-1.75.2-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2026-10-21 01:18:03 UTC

FEDORA-EPEL-2026-954982c495 (rclone-1.75.2-2.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2026-10-21 02:48:45 UTC

FEDORA-EPEL-2026-7f7663646b (rclone-1.75.2-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.