BIT-rclone-2026-116194: Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2 - Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the pCloud backend in Rclone versions 1.52.0 through before 1.75.2 are exposed when performing pCloud OAuth authorization. The affected callback listens on localhost port 53682 during authorization.
What does an attacker need to exploit it?
An attacker needs to get a user to interact with a malicious web page while the user is authorizing pCloud in Rclone. The malicious page can send a stateless request to the localhost OAuth callback on port 53682.
What is the likely impact of a successful attack?
The attacker can plant attacker-controlled tokens and API host settings. Subsequent Rclone transfers may then be directed to the attacker.
How can I determine whether I am affected?
Check whether the installed Rclone version is 1.52.0 or later but earlier than 1.75.2, and whether pCloud OAuth authorization is used. Systems not using the pCloud backend are not described as affected by the provided information.