← Vulnerability feed

Vulnerability record · CVE-2026-88013 · published 10 September 2026

CVE-2026-88013: Rclone information exposure vulnerability

Rclone · Rclone

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

5.3 CVSS 3.1 Medium EPSS 0.19% · top 92.5% CWE-200 · Information exposureCWE-319 · Cleartext transmission
5.3CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
23 Sep 2026Last modified by NVD

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/rclone/rclone/commit/22859b7e696cea3c563c6ba04c6b7f91f74456b4 Patch
https://github.com/rclone/rclone/commit/79fbc0842f74e02cb84f0e3e7261d169983c8831 Patch
https://github.com/rclone/rclone/commit/925fb4fb21eb25e75cd1b64fdd17ded857784bfc Patch
https://github.com/rclone/rclone/releases/tag/v1.75.1 Release Notes
https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r Vendor Advisory
https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r Vendor Advisory

Track CVE-2026-88013 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-88018Rclone improper authentication vulnerabilityrclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 config…EPSS 0.51%9.8CVE-2026-49980Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --…EPSS 0.78%9.2CVE-2026-41179Rclone os command injection vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to…EPSS 5.3%9.2CVE-2026-41176Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is expose…EPSS 3.2%8.8CVE-2026-59733Rclone path traversal vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --…EPSS 0.55%8.8CVE-2026-54572Rclone link following vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclon…EPSS 0.40%7.5CVE-2020-28924Rclone vulnerabilityAn issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak pas…EPSS 1.4%7.5CVE-2018-12907Rclone information exposure vulnerabilityIn Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of an…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-88013), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.