Executive brief
rclone's HTTP storage backend allows users to configure custom authentication headers (like API keys) for accessing remote servers. When a server responds with a redirect to a different host, rclone forwards these secret headers to the new destination without stripping them. An attacker who can redirect traffic or compromise the remote server can capture authentication credentials intended only for the original, trusted host.
Technical details
The HTTP backend in rclone constructs an HTTP client using fshttp.NewClient(ctx) without setting a custom CheckRedirect handler, causing it to fall back to Go's standard library redirect policy. Go's default policy only strips four header names (Authorization, Www-Authenticate, Cookie, Cookie2) when the redirect target's host differs from the original; all other custom headers are forwarded unconditionally. The addHeaders() function in backend/http/http.go writes user-configured secret headers onto every HTTP request. When a redirect occurs—whether from server compromise, an open redirect vulnerability, CDN failover, or a malicious server—rclone resends all configured headers to the new destination. The vulnerability affects all HTTP backend operations: list, stat, download, mount, and serve. No special privileges or user interaction beyond normal operations is required; the attack triggers upon any file operation after a redirect is introduced. A fix implements a custom CheckRedirect function that refuses HTTPS-to-HTTP downgrades and strips configured headers on cross-host redirects.
Affected products
- rclone rclone >=1.49.0, <=1.75.0
Timeline
- 2026-09-04: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Version 1.75.1 patches the vulnerability