Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: rclone 1.75.0 Clear all filters
TI-2026-55257 CVE-2026-79780 · GHSA-fj78-v5f5-cphq

rclone before v1.75.0 Credential Exposure via S3 Redirect

Priority MEDIUM 60

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00147 Published 2026-08-25 Partial fix · 1.75.0 CWE-200
TI-2026-55256 CVE-2026-79779 · GHSA-9mph-vxjp-r3rx

rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

Priority LOW 26

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00108 Published 2026-08-25 Partial fix · 1.75.0 CWE-319
TI-2026-55255 CVE-2026-79778 · GHSA-hqc5-cqqv-7gwf

rclone before v1.75.0 Denial of Service via TUS nil-response panic

Priority MEDIUM 60

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00285 Published 2026-08-25 Partial fix · 1.75.0 CWE-248
TI-2026-55254 CVE-2026-79777 · GHSA-7fxp-9qgr-6fxw

rclone before v1.75.0 Information Disclosure via RC API

Priority MEDIUM 56

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00299 Published 2026-08-25 Partial fix · 1.75.0 CWE-209
TI-2026-55253 CVE-2026-79776 · GHSA-q353-w8p3-4cjq

rclone before 1.75.0 Authentication Bypass via pprof

Priority HIGH 70

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0038 Published 2026-08-25 Fixed in 1.75.0 CWE-200