CVE-2026-79779CWE-319

CVE-2026-79779

Medium · published August 25, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00108 · 1.1th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-08-25T20:17Z
References (2)
https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj · [email protected]https://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to-http-redirect · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:16Z
    rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
    cvelistv5