CVE-2026-116196: Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

Q: Which deployments are exposed to this issue?

Deployments using Rclone versions before 1.75.2 with the b2 backend and the --b2-download-url option are exposed. The described leak occurs when the configured download URL host returns redirects.

Q: What would an attacker need to exploit the credential leak?

An attacker would need to cause or control a redirect from a --b2-download-url host. A same-host HTTPS-to-HTTP downgrade can expose the live B2 Authorization token, while a cross-host redirect can disclose SSE-C customer encryption keys.

Q: Are credentials exposed in the same way for every redirect?

No. The live account Authorization token is described as exposed on same-host redirects that downgrade from HTTPS to HTTP. SSE-C keys are described as disclosed when redirects go to a different host.

Q: What is the available remediation?

Upgrade Rclone to version 1.75.2 or later. The affected versions are those before 1.75.2.

Published Oct 25, 2026

Updated

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.

Affected Software

1 affected component

Rclone Rclone<1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Rclone versions before 1.75.2 with the b2 backend and the --b2-download-url option are exposed. The described leak occurs when the configured download URL host returns redirects.

What would an attacker need to exploit the credential leak?

An attacker would need to cause or control a redirect from a --b2-download-url host. A same-host HTTPS-to-HTTP downgrade can expose the live B2 Authorization token, while a cross-host redirect can disclose SSE-C customer encryption keys.

Are credentials exposed in the same way for every redirect?

No. The live account Authorization token is described as exposed on same-host redirects that downgrade from HTTPS to HTTP. SSE-C keys are described as disclosed when redirects go to a different host.

What is the available remediation?

Upgrade Rclone to version 1.75.2 or later. The affected versions are those before 1.75.2.

CVE-2026-116196: Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What would an attacker need to exploit the credential leak?

Are credentials exposed in the same way for every redirect?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What would an attacker need to exploit the credential leak?

Are credentials exposed in the same way for every redirect?

What is the available remediation?