The vulnerability in rclone causes HTTP backend requests to forward custom authentication or secret headers, such as X-Api-Key, Authorization or Cookie, to a host specified in an HTTP redirect. When a configured remote redirects to an untrusted destination, these headers are resent over the redirect, potentially exposing sensitive credentials. Additionally, a same-host HTTPS-to-HTTP redirect can leak authorization or cookie data in cleartext, allowing an attacker to capture session or authentication tokens. The affected operations, including listing, stat, download, mount, and serve, can trigger these leaks during routine use, granting an attacker the ability to compromise credentials or hijack authenticated sessions.

The issue is present in rclone versions 1.49.0 through 1.75.1, a command-line file synchronization tool that supports multiple cloud storage providers. Any installation of rclone within this version range that configures custom HTTP headers or relies on redirects is susceptible. The vulnerability is fixed in rclone 1.75.1; no earlier or later releases are affected.

The assessment gives a CVSS score of 3.7, indicating a low severity overall, and no EPSS score is available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. However, the failure to block forwarded headers during redirects creates a pathway for credential leakage if the user points rclone at a malicious or compromised endpoint. Based on the description, the likely attack vector is a local or privileged user who can configure rclone to target an attacker-controlled host; in environments where rclone is run automatically or by untrusted users, the risk is higher. The exploit requires that an HTTP redirect be issued by the remote, so preventing redirects or sanitizing headers is the most direct mitigation.