rclone Go Package Vulnerability: Sensitive Information Exposure Risk
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- >= 1.49.0, <= 1.75.0
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the rclone Go package that may expose sensitive information when custom/auth headers are forwarded to a different host on redirect. This issue affects the HTTP backend of rclone versions 1.49.0 to 1.75.0.
What happened
An early warning has been issued for a vulnerability in the rclone Go package. This vulnerability involves the HTTP backend of rclone forwarding custom/auth headers to a different host on redirect, which may expose sensitive information. The affected versions of rclone range from 1.49.0 to 1.75.0. This issue is currently under investigation and no exploitation in the wild has been confirmed.
The vulnerability was first flagged on September 10, 2026. It is recommended to monitor for updates to rclone that address this issue and consider restricting the use of custom/auth headers until a fix is available. The primary sources should be consulted for the most current information and guidance.
What to do about it
- Monitor for updates to rclone that address the vulnerability.
- Consider restricting the use of custom/auth headers in rclone until a fix is available.
- Review your use of rclone and assess whether any sensitive information may have been exposed.
- Consult the primary sources for the most current information and guidance on this vulnerability.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using rclone versions 1.49.0 to 1.75.0.
What should I do right now?
Monitor for updates to rclone and consider restricting the use of custom/auth headers until a fix is available.
Has an official fix been published?
No official fix has been published yet. Monitor the sources for updates.