CVE-2026-79779

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79779

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79779.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79779

Aliases

Downstream

DEBIAN-CVE-2026-79779

Published

2026-08-25T15:16:09.110Z

Modified

2026-08-29T03:30:49.449296101Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

Details

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79779.json",
    "cwe_ids": [
        "CWE-319"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/rclone/rclone

Affected ranges

Type

GIT

Repo

https://github.com/rclone/rclone

Events

Introduced

Fixed

9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.75.0"
        },
        {
            "fixed": "v1.75.0"
        }
    ]
}

Affected versions

v0.*

v0.90

v0.91

v0.92

v0.93

v0.94

v0.95

v0.96

v0.97

v0.98

v0.99

v1.*

v1.00

v1.01

v1.03

v1.04

v1.05

v1.06

v1.07

v1.08

v1.09

v1.10

v1.11

v1.12

v1.13

v1.14

v1.15

v1.16

v1.17

v1.18

v1.19

v1.20

v1.21

v1.22

v1.23

v1.24

v1.25

v1.26

v1.27

v1.28

v1.29

v1.29-1-gbb75d80

v1.30

v1.31

v1.32

v1.33

v1.34

v1.35

v1.36

v1.37

v1.38

v1.39

v1.40

v1.41

v1.42

v1.43

v1.44

v1.45

v1.46

v1.46.0

v1.47.0

v1.48.0

v1.49.0

v1.50.0

v1.51.0

v1.52.0

v1.53.0

v1.54.0

v1.55.0

v1.56.0

v1.57.0

v1.58.0

v1.59.0

v1.60.0

v1.61.0

v1.62.0

v1.63.0

v1.64.0

v1.65.0

v1.66.0

v1.67.0

v1.68.0

v1.69.0

v1.70.0

v1.71.0

v1.72.0

v1.73.0

v1.74.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79779.json"