https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-27T17:25:47.417374+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116190 fkie_cve-2026-116190 2026-10-27T17:25:47.454038+00:00

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.

 https://db.gcve.eu/vuln/ghsa-r8gw-gjgg-66cj GHSA-r8gw-gjgg-66cj 2026-10-27T17:25:47.454112+00:00

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-116190 UBUNTU-CVE-2026-116190 2026-10-27T17:25:47.454134+00:00

Affected: Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:26.10: rclone, Ubuntu:Pro:26.04:LTS: rclone

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.