Technical impact
rclone WebDAV backend forwards custom credential headers, such as those supplied via --webdav-headers, to any host that appears in an HTTP 3xx redirect response. The forwarded headers can contain sensitive authentication tokens (e.g., X‑Auth‑Token) that were intentionally set for the original WebDAV service. When leaked to an attacker, these tokens can be reused to authenticate to the target WebDAV server, revealing confidential credentials.
Affected Systems
All rclone releases from v1.56.0 up to, but excluding, v1.75.2 are affected. The vulnerability is present in the rclone application when used with the WebDAV backend and the --webdav-headers option. Users of these versions should verify whether they configure custom WebDAV headers and whether cross‑host redirects are enabled.
Risk and Exploitability
The CVSS score of 6.3 indicates a medium severity risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to influence an HTTP 3xx redirect that rclone follows—a cross‑host redirect to a malicious host. If the attacker can insert such a redirect into the communication path between the user and the legitimate WebDAV server, the custom credential headers will be forwarded to the attacker, enabling a replay attack against the original service.
