Live › vulnerability › CVE-2026-116196
Go to dashboardRclone before v1.75.2 sends the live Backblaze B2 Authorization token and SSE-C customer encryption keys to hosts reached through HTTP redirects from the --b2-download-url setting. An attacker who can observe or redirect that traffic can capture the cleartext B2 token or the SSE-C keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone with the Backblaze B2 backend and set a custom , especially where traffic passes through networks an attacker can observe or where the download host can redirect. Users of the default B2 endpoints without a custom download URL are less exposed according to the description, but the sources do not confirm this.
--b2-download-urlNo product ranges from the sources yet.
rclone version and check whether it reports a version below v1.75.2.--b2-download-url is set in the rclone config or command line.v1.75.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-116196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.