Is CVE-2026-116196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116196 being exploited in the wild.

How severe is CVE-2026-116196?

Medium severity, with a CVSS score of 5.3, published 25 October 2026.

How is CVE-2026-116196 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-116196?

Check whether you run Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116196: Rclone B2 backend credential exposure on HTTP redirects

CVE-2026-116196 · Severity: medium · CVSS 5.3 · Published 2026-10-25

Rclone is a file synchronization tool that can back up data to cloud storage services like Backblaze B2. When configured to use a custom download URL (commonly a CDN), Rclone may leak the live account authorization token and encryption keys if the CDN performs an HTTPS-to-HTTP downgrade redirect or redirects to another host. An attacker with network access could capture these credentials and gain full account access or decrypt encrypted data.

Technologies: Rclone. Vendors: Rclone.

Quick answers

Is CVE-2026-116196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116196 being exploited in the wild.
How severe is CVE-2026-116196?: Medium severity, with a CVSS score of 5.3, published 25 October 2026.
Which products and versions are affected?: Rclone before v1.75.2.
Is there a fix for CVE-2026-116196?: Yes: fixed in v1.75.2. Until then: Ensure --b2-download-url (if set) always uses an explicit https:// scheme and that the fronting CDN or proxy never issues plaintext HTTP redirects. Avoid pointing download URLs at third-party infrastructure unless you control the redirect policies.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-09"},{"kind":"advisory","at":"2026-10-25"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116196 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-116196?: Check whether you run Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v1.75.2

Ensure --b2-download-url (if set) always uses an explicit https:// scheme and that the fronting CDN or proxy never issues plaintext HTTP redirects. Avoid pointing download URLs at third-party infrastructure unless you control the redirect policies.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-09"},{"kind":"advisory","at":"2026-10-25"}]

Technical details

The vulnerability occurs in the B2 backend's getOrHead function, which sends requests with permanent Authorization headers and SSE-C encryption key headers. When --b2-download-url is set, Go's default HTTP client forwards the Authorization header on same-host redirects regardless of scheme downgrade (HTTPS to HTTP), and forwards custom SSE-C headers to any redirect target including different hosts. An adjacent-network attacker can capture cleartext credentials or encryption keys from redirect chains.

Affected products

Rclone Rclone before v1.75.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.