{"id":"CVE-2026-116190","kind":"vulnerability","aliases":["CVE-2026-116190"],"related":[],"title":"rclone: WebDAV backend leaks custom auth headers across redirects","description":"rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.","summary":"rclone's WebDAV backend forwards operator-configured custom credential headers, such as X-Auth-Token set via --webdav-headers, to a different host when the server answers with an HTTP 3xx redirect. An attacker who controls or influences a cross-host redirect can capture those headers and replay them against the original WebDAV service.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rclone","self-hosted","webdav"],"not_affected_if":["no-custom-headers","no-webdav-backend","rclone-1.75.2-or-later"],"how_to_check":"- Run `rclone version` and check whether it is older than `v1.75.2`\n- Look for `--webdav-headers` or a `headers` setting for WebDAV remotes in rclone configs and scripts","fix":"- Upgrade rclone to `v1.75.2` or later\n- Rotate any token that was sent through `--webdav-headers` if the remote could have redirected to another host","status":"open","published_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:50+00:00","updated_at":"2026-10-25T14:42:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade rclone to `v1.75.2` or later\n- Rotate any token that was sent through `--webdav-headers` if the remote could have redirected to another host","reach":"network","title":"rclone: WebDAV backend leaks custom auth headers across redirects","impact":"medium","summary":"rclone's WebDAV backend forwards operator-configured custom credential headers, such as X-Auth-Token set via --webdav-headers, to a different host when the server answers with an HTTP 3xx redirect. An attacker who controls or influences a cross-host redirect can capture those headers and replay them against the original WebDAV service.","category":"package","nicknames":[],"who_cares":["rclone","webdav","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker captures custom auth tokens and replays them to the WebDAV service","analyst_note":"","how_to_check":"- Run `rclone version` and check whether it is older than `v1.75.2`\n- Look for `--webdav-headers` or a `headers` setting for WebDAV remotes in rclone configs and scripts","needs_analyst":false,"not_affected_if":["no-webdav-backend","no-custom-headers","rclone-1.75.2-or-later"],"who_is_affected":"Teams that run rclone 1.56.0 up to but not including 1.75.2 against WebDAV remotes that use custom credential headers. Exposure depends on whether a redirect to a different host can be controlled or influenced by an attacker, such as a compromised or untrusted WebDAV endpoint or intermediary. Teams that do not use the WebDAV backend or do not set custom headers can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3352,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116190':12A,15A '-2026':11A,14A '3xx':55B,107C 'across':8A 'answer':51B 'attack':58B,109C 'auth':6A,37B,126C 'backend':3A,25B,93C 'captur':69B,120C 'configur':29B,98C 'contain':85C 'control':60B,111C 'credenti':31B,100C 'cross':65B,116C 'cross-host':64B,115C 'custom':5A,30B,99C 'cve':10A,13A 'differ':46B,103C 'disclosur':88C 'forward':26B,95C 'header':7A,32B,43B,71B,101C,121C,132C 'host':20B,47B,66B,104C,117C 'http':54B,106C 'influenc':62B,113C 'inform':87C 'leak':4A 'oper':28B,97C 'operator-configur':27B,96C 'origin':77B,138C 'packag':16B 'rclone':1A,17B,22B,80C 'redirect':9A,56B,67B,108C,118C 'replay':73B,134C 'self':19B 'self-host':18B 'server':50B 'servic':79B,140C 'set':39B,128C 'token':38B,127C 'v1.56.0':82C 'v1.75.2':84C 'via':40B,129C 'vulner':89C 'webdav':2A,21B,24B,42B,78B,92C,131C,139C 'webdav-head':41B,130C 'x':36B,125C 'x-auth-token':35B,124C","nicknames":[],"mitigations":[],"who_affected":"Teams that run rclone 1.56.0 up to but not including 1.75.2 against WebDAV remotes that use custom credential headers. Exposure depends on whether a redirect to a different host can be controlled or influenced by an attacker, such as a compromised or untrusted WebDAV endpoint or intermediary. Teams that do not use the WebDAV backend or do not set custom headers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116190","severity":null,"published_at":"2026-10-25T14:16:59+00:00","modified_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}