rclone WebDAV credential leakage in HTTPS-to-HTTP redirect

Executive brief

rclone is a command-line program used to manage and sync files on various cloud storage providers. A security flaw in its WebDAV component allows sensitive login credentials and session cookies to be sent over unencrypted connections if a server issues a specific type of redirect. An attacker positioned on the same local network could intercept these credentials and gain full access to the user's cloud storage account.

Technical details

The vulnerability exists in rclone's WebDAV implementation where the `PreserveMethodRedirectFn` does not properly validate transport security during redirects. While it limits redirect counts and preserves HTTP methods, it fails to reject transport downgrades (HTTPS to HTTP) or verify the full origin tuple (scheme, host, port). Consequently, it relies on Go's default hostname-oriented header forwarding, which may preserve 'Authorization' and 'Cookie' headers even when switching to plaintext HTTP on the same host. An attacker on an adjacent network could intercept these plaintext credentials if a legitimate endpoint or gateway issues an unsafe redirect. The issue is fixed in version 1.75.0 by ensuring sensitive headers are stripped during scheme downgrades or port changes.

Affected products

• rclone rclone <= 1.74.0

Timeline

• 2026-07-31: patched: Fixed in version 1.75.0
• 2026-08-05: advisory: GitHub Advisory GHSA-h4mf-4v27-hggj published

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D