CVE-2026-79779: Rclone

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

Affected products

• Rclone Rclone: before 1.75.0 (fixed in 1.75.0)

Published 2026-08-25. Last modified 2026-09-10.