CVE-2026-79779: rclone WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
Summary
CVE-2026-79779: rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect. Affects rclone versions < 1.75.0. Fixed in 1.75.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rclone is a command-line program to manage files on cloud storage. It allows users to sync files and directories to and from various cloud storage providers. The tool is widely used for its versatility and support for multiple backends. However, prior to version 1.75.0, rclone had a critical vulnerability that could expose sensitive credentials during redirect handling.
Vulnerability Detail
rclone versions before v1.75.0 are susceptible to a vulnerability that fails to reject transport downgrades in redirect handling. This allows Basic authorization and Cookie headers to be replayed over an unencrypted HTTP connection after an HTTPS-to-HTTP redirect. An attacker positioned on the network can intercept this plaintext traffic, capturing sensitive credentials that can be used to perform unauthorized WebDAV operations with the compromised account's permissions.
How To Fix
Minimum fixed version
1.75.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using rclone with WebDAV over HTTPS-to-HTTP redirects until they can upgrade to the patched version. Additionally, consider using VPNs or secure tunnels to protect data in transit.
Conclusion
The vulnerability CVE-2026-79779 in rclone prior to version 1.75.0 poses a significant risk by exposing sensitive credentials through improper handling of HTTPS-to-HTTP redirects. Users are strongly advised to update to the latest version to mitigate this risk.
See every vulnerability recorded for rclone →
FAQ
An attacker can capture and reuse credentials, leading to unauthorized access to WebDAV operations.
You can check your rclone version by running rclone version in your command line. If it is below 1.75.0, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Consider implementing workarounds such as avoiding the use of WebDAV over HTTP redirects and using secure connections.
Detailed information can be found in the vulnerability database or by visiting the rclone GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for rclone.
