Cleartext transmission of sensitive information in rclone - #VU155813
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to scheme-insensitive redirect trust validation in rclone's fshttp.Transport when following an HTTPS-to-HTTP redirect that preserves the hostname and numeric port. A remote attacker can observe global --header values transmitted in plaintext on the redirected request to disclose sensitive information.
Exploitation requires a command configured with a sensitive global header and access to observe the plaintext network path or receive the request at the HTTP endpoint. Exposure occurs when the request is written, even if the destination does not return a valid response. The HTTP backend's separate --http-headers option is not affected by this bypass.