GO-2026-6197

vendorUSosv

WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

view advisory published 2026-08-18Licence: per source

WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-79779USmedium5.3OT elevated—
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after sa…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan