CVE-2026-88013: rclone http backend header forwarding on redirect

CVE-2026-88013 · Severity: low · CVSS 3.7 · Published 2026-09-10

rclone's HTTP storage backend allows users to configure custom authentication headers (like API keys) for accessing remote servers. When a server responds with a redirect to a different host, rclone forwards these secret headers to the new destination without stripping them. An attacker who can redirect traffic or compromise the remote server can capture authentication credentials intended only for the original, trusted host.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-88013 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88013 being exploited in the wild.
How severe is CVE-2026-88013?
Low severity, with a CVSS score of 3.7, published 10 September 2026.
Which products and versions are affected?
github.com/rclone/rclone (Go) >= 1.49.0, <= 1.75.0, SEMVER:introduced=1.49.0,fixed=1.75.1; Rclone >=1.49.0, <=1.75.0.
Is there a fix for CVE-2026-88013?
Yes. github.com/rclone/rclone (Go): upgrade to 1.75.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88013 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88013?
Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rclone/rclone (Go): upgrade to 1.75.1 or later
    go get github.com/rclone/rclone@v1.75.1

Technical details

The HTTP backend in rclone constructs an HTTP client using fshttp.NewClient(ctx) without setting a custom CheckRedirect handler, causing it to fall back to Go's standard library redirect policy. Go's default policy only strips four header names (Authorization, Www-Authenticate, Cookie, Cookie2) when the redirect target's host differs from the original; all other custom headers are forwarded unconditionally. The addHeaders() function in backend/http/http.go writes user-configured secret headers onto every HTTP request. When a redirect occurs—whether from server compromise, an open redirect vulnerability, CDN failover, or a malicious server—rclone resends all configured headers to the new destination. The vulnerability affects all HTTP backend operations: list, stat, download, mount, and serve. No special privileges or user interaction beyond normal operations is required; the attack triggers upon any file operation after a redirect is introduced. A fix implements a custom CheckRedirect function that refuses HTTPS-to-HTTP downgrades and strips configured headers on cross-host redirects.

Affected products

  • rclone rclone >=1.49.0, <=1.75.0

Identifiers

  • CVE-2026-88013
  • GHSA-486v-q2wf-fp2r
  • GO-2026-6463

Timeline

  • 2026-09-04: disclosed
  • 2026-09-10: advisory
  • 2026-09-10: patched: Version 1.75.1 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.