CVE-2026-88013 rclone CVE debrief

Who should care

Defenders responsible for rclone installations and configurations should assess exposure and verify their versions to prevent potential leaks of sensitive information. This includes operators managing rclone deployments, platform administrators, vulnerability management teams, and security teams who need to prioritize verification and remediation efforts to protect against potential leaks of sensitive information such as X-Api-Key and exposure of sensitive

Why it matters

CVE-2026-88013 is a vulnerability in the rclone command-line program that allows custom secrets to be resent to an untrusted destination during normal use. Defenders should prioritize verifying their rclone versions and configurations to prevent potential leaks of sensitive information.

• Potential leak of sensitive information such as X-Api-Key
• Exposure of Authorization or Cookie headers in cleartext during same-host HTTPS-to-HTTP redirects
• Verification priority for rclone versions and configurations
• Potential impact on listing, stat, download, mount, and serve operations

Technical summary

The rclone command-line program has a vulnerability that allows custom secrets to be resent to an untrusted destination during normal use. The issue arises from the HTTP backend attaching headers configured through --http-headers or headers= to requests, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. This can cause sensitive information such as X-Api-Key to be leaked to another host.

Defensive priority

Defenders should prioritize verifying their rclone versions and configurations to prevent potential leaks of sensitive information.

Recommended defensive actions

• Verify rclone version and upgrade to 1.75.1 if necessary
• Review and restrict HTTP headers configuration
• Monitor for suspicious activity
• Implement compensating controls to protect sensitive information
• Review configurations for potential exposure
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide information on the vulnerability, its impact, and the fix. However, the corpus does not establish versions, exploitation, impact, or remediation for all affected systems, requiring verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.