7.6
Élevée
CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…
Description
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Produits et versions touchés
Autres CVE de rclone
Les 42 CVE de rclone →
CVE-2026-116196
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
6.0
Moyenne
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which…
7.0
Élevée
CVE-2026-116193
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets…
6.9
Moyenne
CVE-2026-116192
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
8.2
Élevée