Cross-Site Request Forgery in Rclone pCloud Backend

Executive Summary

CVE-2026-116194 is a Cross-Site Request Forgery (CSRF) vulnerability in Rclone versions 1.52.0 through 1.75.1. It affects the pCloud backend's OAuth callback mechanism. The vulnerability disables the state check and trusts the hostname parameter, allowing malicious web pages to send unauthorized requests to port 53682 during authorization. Attackers can plant tokens and manipulate API hosts, redirecting file transfers to attacker-controlled servers.

Useful 0 Not Useful 0

Detection Guidance

Check if your Rclone version is between 1.52.0 and 1.75.1 by running 'rclone version'. Inspect network traffic for unauthorized connections to port 53682 during OAuth callbacks. Review Rclone configuration files for unexpected API host entries in the pCloud remote.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to hijack your Rclone remote by planting malicious tokens and API hosts in your configuration. Any subsequent file transfers using that remote will be sent to the attacker's server, potentially exposing sensitive data. The attack requires user interaction during the OAuth flow but can lead to data theft or unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Rclone versions may face data breaches, resulting in legal penalties, reputational damage, and loss of trust. Immediate patching is recommended to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Rclone to version 1.75.2 or later immediately. Disable the pCloud remote in Rclone if not needed. Monitor network traffic for suspicious activity involving port 53682. Review and remove any unauthorized API host entries in your Rclone configuration.

Useful 0 Not Useful 0