Live › vulnerability › CVE-2026-116190
Go to dashboardrclone's WebDAV backend forwards operator-configured custom credential headers, such as X-Auth-Token set via --webdav-headers, to a different host when the server answers with an HTTP 3xx redirect. An attacker who controls or influences a cross-host redirect can capture those headers and replay them against the original WebDAV service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone 1.56.0 up to but not including 1.75.2 against WebDAV remotes that use custom credential headers. Exposure depends on whether a redirect to a different host can be controlled or influenced by an attacker, such as a compromised or untrusted WebDAV endpoint or intermediary. Teams that do not use the WebDAV backend or do not set custom headers can skip it.
No product ranges from the sources yet.
rclone version and check whether it is older than v1.75.2--webdav-headers or a headers setting for WebDAV remotes in rclone configs and scriptsv1.75.2 or later--webdav-headers if the remote could have redirected to another hostEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.