CVE-2026-116194: Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

Q: Which deployments need to be updated?

Rclone versions from 1.52.0 through versions before 1.75.2 are affected when using the pCloud backend OAuth callback. Version 1.75.2 is outside the affected range.

Q: What must happen for exploitation to succeed?

A user must be in the pCloud authorization flow and interact with a malicious web page. The page can send a stateless request to the local OAuth callback on port 53682 during authorization.

Q: What is the practical impact of a successful attack?

The attacker can plant attacker-controlled tokens and API hosts. Subsequent transfers may then be sent to infrastructure controlled by the attacker.

Published Oct 25, 2026

Updated

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.

Affected Software

1 affected component

Rclone Rclone>=1.52.0<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments need to be updated?

Rclone versions from 1.52.0 through versions before 1.75.2 are affected when using the pCloud backend OAuth callback. Version 1.75.2 is outside the affected range.

What must happen for exploitation to succeed?

A user must be in the pCloud authorization flow and interact with a malicious web page. The page can send a stateless request to the local OAuth callback on port 53682 during authorization.

What is the practical impact of a successful attack?

The attacker can plant attacker-controlled tokens and API hosts. Subsequent transfers may then be sent to infrastructure controlled by the attacker.

CVE-2026-116194: Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments need to be updated?

What must happen for exploitation to succeed?

What is the practical impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments need to be updated?

What must happen for exploitation to succeed?

What is the practical impact of a successful attack?