CVE-2026-116190: rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

Q: Which deployments are exposed to this issue?

The reported exposure is limited to rclone WebDAV use where operator-configured custom credential headers are supplied, such as X-Auth-Token through --webdav-headers. The affected version range is v1.56.0 before v1.75.2.

Q: What must an attacker be able to do to obtain a credential header?

An attacker must control or influence an HTTP 3xx redirect that sends the WebDAV request to a different host. The redirected host can then receive the configured credential header and potentially replay it against the original WebDAV service.

Q: Are installations that do not configure custom WebDAV credential headers implicated?

The issue specifically concerns operator-configured custom credential headers forwarded through --webdav-headers. The provided information does not identify other header configurations as affected.

Published Oct 25, 2026

Updated

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.

Affected Software

1 affected component

Rclone Rclone>=1.56.0<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone to a version that resolves this vulnerability.
Fixed in v1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The reported exposure is limited to rclone WebDAV use where operator-configured custom credential headers are supplied, such as X-Auth-Token through --webdav-headers. The affected version range is v1.56.0 before v1.75.2.

What must an attacker be able to do to obtain a credential header?

An attacker must control or influence an HTTP 3xx redirect that sends the WebDAV request to a different host. The redirected host can then receive the configured credential header and potentially replay it against the original WebDAV service.

Are installations that do not configure custom WebDAV credential headers implicated?

The issue specifically concerns operator-configured custom credential headers forwarded through --webdav-headers. The provided information does not identify other header configurations as affected.

CVE-2026-116190: rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to obtain a credential header?

Are installations that do not configure custom WebDAV credential headers implicated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to obtain a credential header?

Are installations that do not configure custom WebDAV credential headers implicated?