{"affected":[{"defaultStatus":"unaffected","ecosystem":"golang","packageName":"github.com/rclone/rclone","product":"rclone","source":"CNA: VulnCheck","vendor":"rclone","versions":[{"lessThan":"1.75.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.75.2","versionType":"semver"}]}],"cveId":"CVE-2026-116196","cwes":["CWE-319"],"description":"Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.","epss":{"date":"2026-11-04","percentile":0.0001,"score":0.00063},"exploits":[],"kev":null,"metrics":[{"score":6,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793813042869,"publishedAt":1792934429804,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/rclone-before-1.75.2-b2-credential-leak-on-redirect-via-b2-download-url"}],"remediation":[],"revision":"77653f33a07c8bb91d1cf60d4ef1a894d8e32e098d12f6f4ad6aed5f6c08b91a","sources":[{"modifiedAt":1793813042869,"name":"CNA: VulnCheck","retrievedAt":1793815814156,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116196"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793815857320,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116196"}],"ssvc":{"assessedAt":1793813030253,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url","updatedAt":1793815857320}