CVE-2026-116196
Received Received - Intake

Rclone Credential Exposure via HTTP Redirect in B2 Backend

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116196
EUVD
EUVD-2026-109454

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rclone before v1.75.2 has a credential exposure flaw in its b2 backend. It leaks live account Authorization tokens and SSE-C encryption keys during HTTP redirects from --b2-download-url hosts. Attackers can exploit HTTPS-to-HTTP downgrades to capture tokens or intercept cross-host redirects to steal encryption keys.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP redirects involving rclone's B2 backend. Check logs for HTTPS-to-HTTP downgrades or cross-host redirects exposing tokens or keys. Use tools like tcpdump or Wireshark to capture and inspect traffic for cleartext credentials during redirects.

Impact Analysis

If you use Rclone with the b2 backend, attackers could steal your Backblaze B2 account tokens or SSE-C encryption keys. This could lead to unauthorized access to your data, data breaches, or loss of data confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of trust in handling sensitive data.

Mitigation Strategies

Upgrade rclone to version 1.75.2 or later to patch the vulnerability. Review and rotate any exposed B2 account Authorization tokens and SSE-C keys immediately. Configure rclone to avoid HTTP redirects or enforce HTTPS-only connections in the B2 backend settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart