MEDIUM 6.0 NVD
CVE-2026-79779
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over pla
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
References
- https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj
- https://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-08-25 via NVD.
vulnfeed aggregates 11954 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.