EUVD-2026-65537
GHSA-9mph-vxjp-r3rx
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector because on-path interception is required; AC:H due to the dependency on the server emitting a same-host HTTPS-to-HTTP redirect; no confidentiality impact beyond credential theft, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
AnalysisAI
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentication passwords, bearer tokens, or session cookies transmitted in cleartext after a same-host HTTPS-to-HTTP redirect. All rclone versions through v1.74.0-240 are affected when the WebDAV backend is configured with Basic credentials or cookie-based authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the rclone WebDAV backend must be configured with Basic authentication credentials, bearer tokens, or session cookies - rclone installations using token-only backends (OAuth, S3, etc.) are not affected; (2) the WebDAV endpoint, an intermediate load balancer, gateway, or CDN in the path must issue a same-host HTTPS-to-HTTP redirect during a rclone session - this is not a default WebDAV server behavior, but can result from misconfiguration, gateway policy, or an adversarial endpoint; (3) the attacker must hold an adjacent or on-path network position capable of observing the plaintext HTTP hop after the redirect is followed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) reflects a realistic but constrained threat: adjacent network access is required (AV:A), exploitation complexity is high (AC:H), and a specific attack precondition must be met (AT:P) - the WebDAV endpoint, gateway, or accelerator must emit a same-host HTTPS-to-HTTP redirect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an adjacent network position - for example, on the same LAN, VLAN, or cloud subnet - intercepts traffic from a host running rclone against a WebDAV endpoint. The WebDAV server or an intermediate gateway issues a legitimate 307 Temporary Redirect from the HTTPS endpoint to an HTTP listener on the same hostname and a different port. … |
| Remediation | Vendor-released patch: v1.75.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rcl
Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both rea
Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during s
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, be
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today