Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79779rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

Medium 5.3

In plain English

A medium-severity security flaw in rclone from rclone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.1%top 98.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rclone	no fix listed	DEBIAN-CVE-2026-79779
Debian:13	rclone	no fix listed	DEBIAN-CVE-2026-79779
Go	github.com/rclone/rclone	1.75.0	GO-2026-6197
Go	github.com/rclone/rclone	1.75.0	GHSA-h4mf-4v27-hggj
Ubuntu:26.10	rclone	no fix listed	UBUNTU-CVE-2026-79779

Affected products (as reported)

Vendor	Product	Versions
rclone	rclone	0 – before 1.75.0

Weakness: CWE-319 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-h4mf-4v27-hggj) vendor-advisory
VulnCheck Advisory: rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect third-party-advisory