Credential Exposure Vulnerability in Rclone B2 Backend

CVE-2026-116196

What is CVE-2026-116196?

Rclone versions prior to v1.75.2 are susceptible to a credential exposure vulnerability within the B2 backend. This issue arises during HTTP redirects initiated from the --b2-download-url parameter, leading to potential leaking of sensitive information such as live account Authorization tokens and SSE-C encryption keys. Attackers can exploit this vulnerability through a same-host HTTPS-to-HTTP downgrade, allowing them to intercept cleartext B2 tokens. Additionally, cross-host redirects may unintentionally disclose SSE-C customer encryption keys, further compromising user security.

References