CVE-2026-79779EPSS p1.1%

CVE-2026-79779CVE-2026-79779

Description

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS0.11% probability of exploitation · percentile 1.1% · 2026-10-05T12:00:23Z
Last modified2026-09-10
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.