CVE-2026-116190
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Oct 25, 2026
Vendor
unknown
Description
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.