rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in version 1.75.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers
    or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects
    without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another
    host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and
    a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat,
    download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in
    version 1.75.1. (CVE-2026-88013)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers     or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects     without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another     host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and     a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat,     download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in     version 1.75.1. (CVE-2026-88013)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447913	SCA: security update for github.com/rclone/rclone (GHSA-486v-q2wf-fp2r)	Tenable Cloud Security	SCA Checks	Local	low
447913	SCA: security update for github.com/rclone/rclone (GHSA-486v-q2wf-fp2r)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
344688	Linux Distros Unpatched Vulnerability : CVE-2026-88013	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-88013

low

Tenable Plugins

low

low

low