CVE-2026-116194GHSA-hvpr-p4pv-4f46
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
rclone rclone
CVSS
7.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.75.2rcloneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Text from CVE List
Affected versions 2
- rcloneaffected: 1.52.0 before 1.75.2CVE List
- rcloneunaffected: 1.75.2CVE List