This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-79779 →

DEBIAN-CVE-2026-79779

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replaye...

Original description

The description as published by the source.

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org