Rclone
CVE-2026-116196: Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redi
CVE-2026-116196 Oct 25, 2026 Source: Vendor
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-116196
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3 matching , clear filters
CVE-2026-116196
BR2026-0000-032248
unclaimed
Credited as sonicnew
CVE-2026-116196
BR2026-0000-032249
unclaimed
Credited as iaohkut
CVE-2026-116196
BR2026-0000-032250
unclaimed
Credited as ncw