CVE-2026-88013
Received Received - Intake

rclone HTTP Backend Header Leak via Redirects

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88013
EUVD
EUVD-2026-75567

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
rclone rclone to 1.75.1 (exc)
-rclone rclone From 1.49.0 (inc) to 1.75.1 (inc)
rclone rclone From 1.49.0 (inc) to 1.75.1 (exc)
rclone rclone 1.75.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in rclone (versions 1.49.0 to 1.75.1) involves the HTTP backend sending configured headers like API keys or cookies to unintended hosts during redirects. The issue occurs because rclone's HTTP client follows redirects without properly stripping custom headers, allowing sensitive data to leak to untrusted destinations or be exposed in plaintext during HTTPS-to-HTTP downgrades.

Detection Guidance

To detect this vulnerability, monitor HTTP traffic for unexpected header forwarding during redirects. Check rclone logs for cross-host redirects or HTTPS-to-HTTP downgrades. Use tools like tcpdump or Wireshark to inspect network traffic for exposed headers.

Impact Analysis

An attacker could intercept sensitive headers like Authorization or X-Api-Key if a redirect leads to a malicious host. HTTPS-to-HTTP downgrades could expose credentials in cleartext. Operations like listing, downloading, or mounting files may trigger this leak during normal use.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade rclone to version 1.75.1 or later. Avoid using --http-headers or headers= for sensitive data. Review redirect configurations to ensure no untrusted hosts are involved. Monitor for unusual redirect patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart