rclone EUVD-2026-65537

Exploitation requires three concurrent conditions: (1) the rclone WebDAV backend must be configured with Basic authentication credentials, bearer tokens, or session cookies - rclone installations using token-only backends (OAuth, S3, etc.) are not affected; (2) the WebDAV endpoint, an intermediate load balancer, gateway, or CDN in the path must issue a same-host HTTPS-to-HTTP redirect during a rclone session - this is not a default WebDAV server behavior, but can result from misconfiguration, gateway policy, or an adversarial endpoint; (3) the attacker must hold an adjacent or on-path network position capable of observing the plaintext HTTP hop after the redirect is followed. Limiting factors: AV:A constrains the attacker to adjacent network segments; AC:H and AT:P indicate the redirect condition is not guaranteed to occur; a malicious original WebDAV endpoint does not benefit from this attack since it already receives credentials directly.

The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) reflects a realistic but constrained threat: adjacent network access is required (AV:A), exploitation complexity is high (AC:H), and a specific attack precondition must be met (AT:P) - the WebDAV endpoint, gateway, or accelerator must emit a same-host HTTPS-to-HTTP redirect. The high confidentiality impact (VC:H) is accurate because captured Basic passwords and session cookies are complete, reusable credentials. No EPSS data was provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV, and no publicly circulating exploit code has been identified beyond the controlled PoC in the GHSA advisory. The practical risk is moderate: it requires a specific network position plus a misconfigured or adversarially controlled WebDAV gateway, making mass exploitation unlikely. For organizations running rclone against WebDAV endpoints over infrastructure they do not fully control, the risk of targeted credential theft is meaningful.

An attacker with an adjacent network position - for example, on the same LAN, VLAN, or cloud subnet - intercepts traffic from a host running rclone against a WebDAV endpoint. The WebDAV server or an intermediate gateway issues a legitimate 307 Temporary Redirect from the HTTPS endpoint to an HTTP listener on the same hostname and a different port. rclone follows the redirect while preserving the WebDAV method and forwards the Authorization: Basic header and configured cookies in cleartext, which the attacker captures and replays to perform WebDAV read or write operations under the compromised account's permissions.