The vulnerability allows an attacker on the network path to intercept an HTTPS request that is redirected to HTTP, causing the client to retransmit Basic authentication and Cookie headers over an insecure connection. The attacker can capture these credentials and reuse them to perform WebDAV operations with the compromised account’s permissions. The flaw does not provide direct code execution or denial‑of‑service but results in credential compromise and unauthorized access to stored data.

rclone packages before version 1.75.0 are affected. The vendor product is rclone rclone; no sub‑product or component distinction is noted. Any deployment using these older releases that performs HTTPS‑to‑HTTP redirects when accessing WebDAV resources is vulnerable.

The CVSS score of 6.0 indicates a moderate severity. The EPSS score is below 1%, reflecting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an on‑path attacker who can observe the traffic between the client and a single host. The exploit is straightforward: observe the redirect, capture the credential headers, and replay them over HTTP. Security controls such as TLS enforcement, network segmentation, or disabling redirects mitigate the risk.