CVE-2026-116190 rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116190?
CVE-2026-116190 is a medium-severity vulnerability in rclone, published on 25 Oct 2026.
Official description
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
Weakness: CWE-200
Which versions are affected by CVE-2026-116190?
1 open source package ship an affected version, including rclone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rclone Bitnami | From 1.56.0 | 1.75.2 |
Products include Rclone Rclone.
How do I fix CVE-2026-116190?
Upgrade rclone to 1.75.2 or later.
Is CVE-2026-116190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116190 exists.
Other vulnerabilities in rclone
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Sources
Also known as BIT-rclone-2026-116190, DEBIAN-CVE-2026-116190, GHSA-3rqf-7h69-gg5v, GHSA-r8gw-gjgg-66cj, UBUNTU-CVE-2026-116190.