CVE-2026-79779: rclone Auth Bypass Vulnerability

CVE-2026-79779 Overview

CVE-2026-79779 affects rclone versions before v1.75.0. The client fails to reject transport downgrades during redirect handling. When a WebDAV server issues a same-host HTTPS-to-HTTP redirect, rclone replays Authorization (Basic) and Cookie headers over plaintext HTTP. An on-path attacker on the adjacent network can observe the plaintext hop and capture the credentials. The attacker can then reuse those credentials to perform WebDAV operations with the compromised account's permissions. This falls under [CWE-319] Cleartext Transmission of Sensitive Information.

Critical Impact
On-path attackers can capture Basic authentication credentials and session cookies, enabling unauthorized WebDAV access with the victim's permissions.

Affected Products

rclone versions prior to v1.75.0
rclone WebDAV backend configurations using Basic authentication
rclone deployments relying on cookie-based session state over HTTPS

Discovery Timeline

2026-08-25 - CVE-2026-79779 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79779

Vulnerability Analysis

rclone is a command-line utility for managing files across cloud storage providers, including WebDAV endpoints. The client library follows HTTP redirects returned by remote servers. Before v1.75.0, the redirect handler did not enforce that the target scheme match or exceed the origin scheme. A server response that redirects from https://host/path to http://host/path causes rclone to reissue the request with sensitive headers intact.

The Authorization: Basic header contains base64-encoded username and password pairs. Once transmitted over plaintext HTTP, any attacker with visibility into the network path can decode the credentials. Cookie headers similarly expose session identifiers that grant equivalent account access.

Root Cause

The root cause is missing scheme validation in the HTTP redirect logic. Standard practice requires clients to strip authentication material or refuse the redirect entirely when transport security is downgraded. rclone did neither for same-host redirects, treating the destination as trusted because the hostname matched.

Attack Vector

Exploitation requires an attacker positioned on the adjacent network path between rclone and the WebDAV server. The attacker either operates a malicious or compromised WebDAV server, or manipulates responses via an active on-path position. The server returns a 301, 302, or 307 response pointing to an http:// URL on the same host. rclone follows the redirect and transmits the credentials in cleartext, which the attacker captures. Refer to the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-79779

Indicators of Compromise

Outbound plaintext HTTP requests from hosts running rclone that carry Authorization: Basic or Cookie headers
WebDAV server logs showing 3xx redirects from HTTPS listeners to HTTP endpoints for the same host
Unexpected WebDAV operations authenticated with valid user credentials from unfamiliar source addresses

Detection Strategies

Inventory rclone installations across the environment and identify versions below v1.75.0
Inspect network telemetry for HTTP traffic containing Basic authentication headers originating from rclone user agents
Correlate WebDAV access logs with expected client identities to surface credential reuse

Monitoring Recommendations

Log and alert on HTTP redirect responses that downgrade from HTTPS to HTTP for WebDAV endpoints
Track rclone process telemetry and command-line arguments to identify vulnerable clients
Monitor WebDAV authentication events for anomalous source addresses or off-hours activity

How to Mitigate CVE-2026-79779

Immediate Actions Required

Upgrade rclone to v1.75.0 or later on all systems that access WebDAV endpoints
Rotate any credentials that rclone may have transmitted, especially Basic authentication passwords used against WebDAV servers
Invalidate active WebDAV session cookies tied to affected accounts

Patch Information

rclone v1.75.0 rejects transport downgrades during redirect processing. The GitHub Security Advisory GHSA-h4mf-4v27-hggj documents the fix. Additional context is available in the VulnCheck Advisory for Rclone.

Workarounds

Restrict rclone WebDAV traffic to trusted network paths until patching completes
Replace Basic authentication with token- or certificate-based authentication where the WebDAV server supports it
Configure WebDAV servers to reject or omit redirects that would downgrade transport security

bash

# Verify installed rclone version and upgrade
rclone version
# Upgrade using the official installer
curl https://rclone.org/install.sh | sudo bash