Executive brief
rclone is a command-line utility for syncing files to cloud storage and WebDAV servers. Versions before v1.75.0 fail to reject downgrades from HTTPS to plaintext HTTP when a server redirects traffic, allowing attackers positioned on the network path to intercept and replay authentication credentials (passwords and session cookies) to access the compromised account's WebDAV files.
Technical details
The vulnerability is a cleartext transmission issue (CWE-319) in rclone's redirect handling for WebDAV backends. The PreserveMethodRedirectFn function in lib/rest/rest.go restores the HTTP method on redirects but fails to reject same-host HTTPS-to-HTTP downgrades or compare the full origin tuple (scheme, hostname, port). As a result, Go's built-in credential-forwarding rules preserve Basic authentication headers and Cookie values even when the new endpoint uses plaintext HTTP. An adjacent or on-path attacker observing the plaintext hop can capture and replay these credentials for WebDAV operations without requiring authentication. The vulnerability requires a legitimate WebDAV endpoint to emit a 307/308 redirect to HTTP on the same hostname and an adjacent network position to intercept traffic. Patches are available in v1.75.0 and later.
Affected products
- rclone rclone < v1.75.0
Timeline
- 2026-07-31: disclosed
- 2026-08-25: patched: v1.75.0 released