{"id":"EUVD-2026-65537","enisaUuid":"68001be9-714c-3863-bdb4-73e5dc3998fd","description":"rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account\u0027s permissions.","datePublished":"Aug 25, 2026, 3:16:09 PM","dateUpdated":"Aug 27, 2026, 4:45:55 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj\nhttps://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to-http-redirect\n","aliases":"CVE-2026-79779\nGHSA-9mph-vxjp-r3rx\n","assigner":"VulnCheck","epss":0.11,"enisaIdProduct":[{"id":"2e6d0aec-3091-39ba-85be-8d10b314eee7","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"0 \u003c1.75.0"}],"enisaIdVendor":[{"id":"c8f9872f-63ca-33b8-9950-f25145091d69","vendor":{"name":"rclone"}}],"enisaIdVulnerability":[{"id":"caefc88f-b63d-384f-9329-6f15478dc1d3","vulnerability":{"id":"CVE-2026-79779","description":"rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account\u0027s permissions.","datePublished":"Aug 25, 2026, 3:16:09 PM","dateUpdated":"Aug 27, 2026, 4:45:55 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj\nhttps://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to-http-redirect\n","enisa_id":"EUVD-2026-65537\n","assigner":"VulnCheck","epss":0.11,"dataProcessed":"Nov 5, 2026, 7:15:39 AM","vulnerabilityProduct":[{"id":"7cfe2066-ec21-3b22-af86-7ee5aa7df4c2","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"0 \u003c1.75.0"}],"vulnerabilityVendor":[{"id":"e1a5d879-1094-376d-9bf7-fc929a7001bf","vendor":{"name":"rclone"}}]}},{"id":"e4ce0823-f49b-3998-83b1-9076349b9a40","vulnerability":{"id":"GHSA-9mph-vxjp-r3rx","description":"rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account\u0027s permissions.","datePublished":"Aug 25, 2026, 6:31:54 PM","dateUpdated":"Aug 25, 2026, 6:31:54 PM","baseScore":0.0,"references":"https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79779\nhttps://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to-http-redirect\n","enisa_id":"EUVD-2026-65537\n","aliases":"CVE-2026-79779\nGHSA-9mph-vxjp-r3rx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}