---
id: CVE-2026-88013
title: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers
summary: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend
  attaches headers configured through --http-headers or headers= to requests in
  backen…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-319
  - CWE-522
  - CWE-212
vendor: rclone
product: rclone
affected:
  - 'rclone >= 1.49.0, < 1.75.1'
patched:
  - rclone 1.75.1
published: '2026-09-10'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:28:10.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88013'
references:
  - url: >-
      https://github.com/rclone/rclone/commit/22859b7e696cea3c563c6ba04c6b7f91f74456b4
    label: security-advisories@github.com
  - url: >-
      https://github.com/rclone/rclone/commit/79fbc0842f74e02cb84f0e3e7261d169983c8831
    label: security-advisories@github.com
  - url: >-
      https://github.com/rclone/rclone/commit/925fb4fb21eb25e75cd1b64fdd17ded857784bfc
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88013'
  - url: 'https://github.com/rclone/rclone'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88013.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88013'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531530'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88013'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00187
epssPercentile: 0.07307
aliases:
  - GHSA-486v-q2wf-fp2r
  - GO-2026-6463
  - BIT-rclone-2026-88013
ecosystem: go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T16:12:41.126762Z'
ingestedAt: '2026-09-14T02:48:07.129Z'
---

## Overview

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

## Affected

- `rclone >= 1.49.0, < 1.75.1`

## Remediation

Upgrade past the affected range:

- `rclone 1.75.1`

## Package advisory (CVE-2026-88013)

Affected packages:

- `github.com/rclone/rclone >= 1.49.0, < 1.75.1`

Patched in:

- `github.com/rclone/rclone 1.75.1`

Source: https://osv.dev/vulnerability/GHSA-486v-q2wf-fp2r

## Vendor advisories

- **Red Hat VEX** · Low · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88013.json)