CVE-2026-79779
Received Received - Intake

rclone Credential Replay via HTTPS-to-HTTP Redirect Downgrade

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79779
EUVD
EUVD-2026-65537

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone to 1.75.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79779 is a vulnerability in rclone versions before v1.75.0 where WebDAV credentials like Basic passwords, bearer tokens, and session cookies can be exposed during same-host HTTPS-to-HTTP redirects. The redirect handling fails to reject transport downgrades, preserving sensitive headers even when switching to plaintext HTTP. An on-path attacker can capture and reuse these credentials to perform unauthorized WebDAV operations.

Detection Guidance

Monitor network traffic for same-host HTTPS-to-HTTP redirects involving rclone WebDAV operations. Check if sensitive headers like Authorization or Cookie are preserved during these redirects. Use tools like tcpdump or Wireshark to inspect traffic for plaintext credential exposure.

Impact Analysis

If you use rclone versions before v1.75.0, an attacker could intercept and reuse your WebDAV credentials during HTTPS-to-HTTP redirects. This could allow unauthorized access to your WebDAV operations, potentially leading to data breaches or unauthorized modifications. The impact is limited to confidentiality breaches as integrity and availability are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected rclone versions may fail to protect personal or health data during transmission, risking non-compliance with data protection regulations.

Mitigation Strategies

Upgrade rclone to version v1.75.0 or later. Configure rclone to reject HTTPS-to-HTTP redirects and strip authentication headers on unsafe redirects. Implement strict destination allowlists for WebDAV operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79779. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart