Information Disclosure in rclone WebDAV Backend Affects User Credentials

CVE-2026-116190

What is CVE-2026-116190?

rclone versions prior to v1.75.2 present a security vulnerability in the WebDAV backend, whereby operator-configured custom credential headers may be leaked during HTTP 3xx redirects. This issue enables attackers who can manipulate cross-host redirects to intercept sensitive headers, such as the X-Auth-Token specified through --webdav-headers, which can then be misused against the original WebDAV service, potentially compromising user data and security.

References