CVE-2026-116196 rclone CVE debrief

Who should care

Defenders responsible for Rclone deployments should assess exposure and prioritize verification and remediation. This includes reviewing and updating configurations for --b2-download-url hosts, monitoring for potential credential exposure, and implementing compensating controls for exposed systems. Security teams and vulnerability management teams should also be aware of the potential impact on data confidentiality and integrity.

Why it matters

Defenders should care about CVE-2026-116196 because it affects Rclone deployments, potentially leading to credential exposure and unauthorized access. Verification and remediation are necessary to prevent exploitation.

• Potential credential exposure and unauthorized access
• Need to verify and upgrade Rclone version to prevent exploitation
• Possible impact on data confidentiality and integrity

Technical summary

The vulnerability is caused by a credential exposure issue in the b2 backend of Rclone before v1.75.2, which leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. This issue affects Rclone deployments and could lead to unauthorized access. Defenders should prioritize verifying and upgrading to Rclone version 1.75.2 or later to mitigate the credential exposure vulnerability. The vulnerability can be exploited through HTTP redirects, allowing attackers to capture sensitive information.

Defensive priority

Defenders should prioritize verifying and upgrading to Rclone version 1.75.2 or later to mitigate the credential exposure vulnerability.

Recommended defensive actions

• Verify Rclone version and upgrade to 1.75.2 or later
• Review and update configurations for --b2-download-url hosts
• Monitor for potential credential exposure
• Perform vulnerability scanning and penetration testing to identify potential exposure
• Review access controls and authentication mechanisms for Rclone deployments
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure effectiveness of remediation efforts

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The vendor advisory and third-party advisory provide additional information on the vulnerability. Defenders should verify Rclone version and configurations for --b2-download-url hosts to prevent exploitation. The live account Authorization token and SSE-C keys are sensitive information that must be protected. Evidence of exposure should be reviewed and remediated promptly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.