Cross-Site Request Forgery Vulnerability in Rclone by Rclone

CVE-2026-116194

What is CVE-2026-116194?

Rclone versions prior to 1.75.2 are susceptible to a cross-site request forgery vulnerability in the pCloud backend. This flaw occurs during the OAuth authorization process, where the state check is disabled and the hostname parameter is erroneously trusted. As a result, malicious websites can exploit this weakness by sending unauthorized requests to Rclone's localhost port 53682, enabling attackers to insert unauthorized tokens and API hosts. Consequently, any file transfers initiated may be redirected to the attacker's endpoint, posing severe risks to data integrity and user privacy.

References