Skip to content
fr Sign in
7.6 High

CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…

Description

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.

Affected products and versions

Product Affected versions Fixed in
rclone 1.75 earliest → < 1.75.2 1.75.2
rclone 1.52 1.52.0 → < 1.75.2 1.75.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of rclone

The 42 CVEs of rclone →
CVE-2026-116196 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url 6.0 Medium CVE-2026-116195 Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which… 7.0 High CVE-2026-116193 Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets… 6.9 Medium CVE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots 8.2 High
Track this CVE