Cleartext transmission of sensitive information in rclone - #VU140649
Published: August 1, 2026
Vulnerability identifier: #VU140649
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to cleartext transmission of sensitive information in lib/http server TLS handling when multiple --addr flags are used with --cert and --key. A remote attacker can connect to the service over plaintext to disclose sensitive information.
The issue occurs only when more than one listen address is configured, causing the service to be served without TLS despite certificate settings.
Affected software
rclone
Remediation
Install security update from vendor's website.
rclone - update to 1.75.0