Detections
Analytics

SCA: security update for github.com/rclone/rclone (GHSA-486v-q2wf-fp2r)

low Tenable Cloud Security Plugin ID 447913

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - rclone is a command-line program to sync files and directories to and from different cloud storage
 providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers
 or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects
 without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another
 host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and
 a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat,
 download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in
 version 1.75.1. (CVE-2026-88013)

Solution

Update the github.com/rclone/rclone library and its related packages to version 1.75.1 or later.

See Also

https://github.com/advisories/GHSA-486v-q2wf-fp2r

Plugin Details

Severity: Low

ID: 447913

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/11/2026

Updated: 9/11/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-88013

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/10/2026

Vulnerability Publication Date: 9/10/2026

Reference Information

CVE: CVE-2026-88013