Live › vulnerability › CVE-2026-116194
Go to dashboardRclone's pCloud backend accepts a localhost OAuth callback without checking the state value and trusts a hostname parameter. A malicious web page can send a request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers go to the attacker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone on a workstation or server with a pCloud remote configured and an authorization flow in progress while browsing the web. Machines with no pCloud remote, or running 1.75.2 or later, are not exposed.
No product ranges from the sources yet.
rclone version and compare against the fixed releaserclone listremotes, then look for pCloud entries in rclone.conf)1.75.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
This page as .md · .json · in your agent: get_signal("CVE-2026-116194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.