rclone WebDAV CVE-2026-116190

Requires all of: (1) a WebDAV remote configured with an operator-set custom credential header via the --webdav-headers / headers option (e.g. X-Auth-Token or X-Api-Key) - standard Authorization/Cookie headers are NOT affected because Go's net/http strips those across registrable domains; (2) rclone in the affected range (1.56.0 through 1.75.1, fixed in v1.75.2); (3) the configured WebDAV server emitting a cross-host, non-downgrade 3xx redirect; and (4) the attacker being able to influence that redirect target via an open redirect, a compromised or malicious endpoint, or an on-path position on a cleartext or same-host hop. The leak occurs in the default configuration and does not depend on the opt-in auth_redirect option. Limiting factors: exploitation is confined to deployments that use custom-named credential headers and that encounter an attacker-controllable redirect, which is why CVSS rates attack complexity high (AC:H) with a present attack requirement (AT:P); no attacker authentication is required (PR:N).

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, base 6.3, medium) is internally coherent with the described mechanism: network vector (AV:N), no attacker privileges (PR:N), no victim UI (UI:N), but elevated attack complexity (AC:H) and a present attack requirement (AT:P) because exploitation depends on the attacker being able to influence a cross-host, non-downgrade 3xx redirect - an open redirect, a compromised/malicious endpoint, or an on-path position on a cleartext or same-host hop. Impact is confidentiality-only and rated low (VC:L) because a single reusable credential header is disclosed; there is no direct integrity or availability impact. No EPSS score is provided in the input, and there is no CISA KEV listing, so there is no confirmed active exploitation - this is therefore not a KEV-driven emergency. A public PoC reference exists in the GHSA advisory (reproduction steps), but the advisory states the accompanying Go tests were reviewed against source rather than executed, so it is not verified as working exploit code. The vendor priority Decision label is this_month, consistent with a real but non-emergency issue that should be remediated promptly rather than paniced over. Net: a genuine credential-disclosure flaw gated behind a specific operator configuration (custom credential header) plus an attacker-influenced redirect, making it a moderate, targeted-exploitation risk rather than a mass-exploited critical.

An operator configures a WebDAV remote in rclone with a custom credential header (for example --webdav-headers "X-Auth-Token,SECRET") pointing at a third-party host. An attacker who controls or can influence that host's redirect response (open redirect, compromised endpoint, or on-path hop) causes the server to return a cross-host 3xx redirect; rclone follows it and re-sends the custom credential header verbatim to the attacker-controlled target, where it is captured and later replayed against the original WebDAV service. A public PoC reference with reproduction steps exists but is not verified as working exploit code; the high attack complexity reflects the need to influence the redirect.