CVE-2026-79779: rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in v1.75.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using rclone versions before 1.75.0 for WebDAV are exposed when a same-host redirect sends an HTTPS request to HTTP. The issue concerns requests carrying Basic authorization or Cookie headers.
What must an attacker be able to do to exploit this?
An attacker must be on the network path where they can observe the plaintext HTTP request created after the HTTPS-to-HTTP redirect. They can capture the replayed authorization or cookie credentials and reuse them for WebDAV operations permitted to the compromised account.
Is user interaction or prior authentication required?
No user interaction or attacker privileges are required according to the supplied vector. However, exploitation depends on the redirect condition and an attacker being able to observe the resulting plaintext hop.
What is the remediation?
Upgrade rclone to version 1.75.0 or later. If upgrading is not immediately possible, avoid WebDAV configurations or paths that can redirect same-host HTTPS requests to HTTP, and prevent plaintext HTTP traffic from being observable on the network.