Bug 2560440 (CVE-2026-116194)

Summary: CVE-2026-116194 github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, cmah, eaguilar, ebaron, gparvin, jbalunas, jmatsuok, jtolenti, pjindal, rhaigner, tsze
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state and improperly trusts external host parameters. By tricking a user into visiting a malicious webpage during the authorization process, an attacker can inject rogue access tokens and endpoints, causing subsequent file transfers to reach an attacker-controlled server.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-25 13:34:46 UTC 
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.