DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88013: CVE-2026-88013: Sensitive Header Leakage via Unvalidated HTTP Redirects in rclone

#security #cve #cybersecurity

CVE-2026-88013: Sensitive Header Leakage via Unvalidated HTTP Redirects in rclone

Vulnerability ID: CVE-2026-88013
CVSS Score: 3.7
Published: 2026-09-10

rclone versions from 1.49.0 up to 1.75.1 are vulnerable to information disclosure and credential leakage. When configuring custom headers on HTTP connections, rclone fails to strip those headers when following HTTP redirects to external untrusted domains. Additionally, rclone does not prevent scheme downgrades from HTTPS to HTTP on same-host redirects, allowing sensitive standard credentials to be transmitted in cleartext.

TL;DR

rclone leaks user-configured custom HTTP headers to external untrusted hosts during redirects and allows scheme downgrades to plaintext HTTP.

Technical Details

  • CWE ID: CWE-200, CWE-319, CWE-522
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 3.7 (Low)
  • EPSS Score: 0.00043 (extremely low probability)
  • Exploit Status: None (no public PoCs or active exploits)
  • CISA KEV Status: Not Listed

Affected Systems

  • rclone
  • rclone: >= 1.49.0, < 1.75.1 (Fixed in: 1.75.1)

Code Analysis

Commit: 22859b7

Fix: HTTP backend client CheckRedirect policy to prevent header leakage and downgrade

Commit: 79fbc08

Fix: Clear global custom headers when redirects cross hosts in Transport

Commit: 925fb4f

Fix: Restrict HTTPS-to-HTTP scheme downgrades on same-host redirects

Mitigation Strategies

  • Upgrade to rclone version 1.75.1 or later
  • Avoid passing sensitive tokens using custom headers when targeting untrusted HTTP backends
  • Enforce strict HTTPS-only endpoints for all HTTP-based remotes
  • Implement network egress filtering to restrict traffic to known safe backup destinations

Remediation Steps:

  1. Identify all deployed rclone versions in your environment using the command: rclone version
  2. Upgrade all installations running version 1.49.0 to 1.75.1 to the latest stable release (1.75.1 or newer)
  3. Review configuration files (rclone.conf) for occurrences of headers =, --http-headers, --header, and --header-download
  4. If legacy installations cannot be upgraded, replace custom authorization headers with secure authentication backends or configure strict reverse proxies that do not redirect client traffic

References

Read the full report for CVE-2026-88013 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)