Bug 2560457 (CVE-2026-116190) - CVE-2026-116190 github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects
Summary: CVE-2026-116190 github.com/rclone/rclone: rclone: Information disclosure via ...
Keywords:
Status: NEW
Alias: CVE-2026-116190
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-25 13:36 UTC by OSIDB Bzimport
Modified: 2026-10-26 05:46 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-25 13:36:11 UTC 
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
Note You need to log in before you can comment on or make changes to this bug.