CVE-2026-116190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116190", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-25T12:27:12.266Z", "datePublished": "2026-10-25T13:20:25.832Z", "dateUpdated": "2026-10-29T16:17:28.780Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-25T13:20:25.832Z"}, "datePublic": "2026-10-09T00:00:00.000Z", "title": "rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect", "descriptions": [{"lang": "en", "value": "rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "rclone", "product": "rclone", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "versions": [{"version": "1.56.0", "status": "affected", "versionType": "semver", "lessThan": "1.75.2"}, {"version": "1.75.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.56.0", "versionEndExcluding": "1.75.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-3rqf-7h69-gg5v)"}, {"name": "VulnCheck Advisory: rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect"}], "credits": [{"lang": "en", "value": "manus-pi", "type": "reporter"}, {"lang": "en", "value": "ncw", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T16:17:00.427990Z", "id": "CVE-2026-116190", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T16:17:28.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116190", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T16:17:00.427990Z"}}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T16:17:18.638Z"}}], "cna": {"title": "rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect", "credits": [{"lang": "en", "type": "reporter", "value": "manus-pi"}, {"lang": "en", "type": "finder", "value": "ncw"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "1.56.0", "lessThan": "1.75.2", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/rclone/rclone", "defaultStatus": "unaffected"}], "datePublic": "2026-10-09T00:00:00.000Z", "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v", "name": "GitHub Security Advisory (GHSA-3rqf-7h69-gg5v)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect", "name": "VulnCheck Advisory: rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.75.2", "versionStartIncluding": "1.56.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-25T13:20:25.832Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116190", "state": "PUBLISHED", "dateUpdated": "2026-10-29T16:17:28.780Z", "dateReserved": "2026-10-25T12:27:12.266Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-25T13:20:25.832Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "product": "rclone", "vendor": "rclone", "versions": [{"lessThan": "1.75.2", "status": "affected", "version": "1.56.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "matchCriteriaId": "6028A710-C994-4B2C-BEC0-95D6490E86BC", "versionEndExcluding": "1.75.2", "versionStartIncluding": "1.56.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service."}], "id": "CVE-2026-116190", "lastModified": "2026-10-29T17:18:04.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116190", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T16:17:00.427990Z", "version": "2.0.3"}}]}, "published": "2026-10-25T14:16:59.260", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects", "id": "2560457", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560457"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in rclone. When interacting with WebDAV storage services, rclone inadvertently forwards user-configured custom credential headers to external destinations across HTTP redirects. A remote attacker who controls or influences a target redirect server could intercept sensitive authentication headers and reuse them against the legitimate service, resulting in information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-116190", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-10-25T13:20:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116190\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116190\nhttps://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v\nhttps://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect"], "statement": "This flaw is rated as Low impact for Red Hat products because successful exploitation requires highly specific preconditions, including an operator supplying custom authentication tokens to a WebDAV remote and an external entity actively manipulating redirect responses. In supported Red Hat offerings such as Red Hat Advanced Cluster Management (RHACM) and Cryostat, the embedded tool is utilized primarily for internal data movement and snapshot replication across trusted, preconfigured endpoints rather than arbitrary remote services. Consequently, unauthorized header propagation does not compromise system integrity or availability, and exposure is confined to environments explicitly routing sensitive requests through unvetted redirect endpoints.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.56.0,1.75.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.75.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-10-25T17:15:15.613739+00:00", "updated": "2026-10-26T14:00:19.716556+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}