PT-2026-123035

CVE-2026-116194

Published

2026-10-25

Updated

2026-10-29

Description by

CVSS 4.0

7.6

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Rclone versions 1.52.0 through 1.75.1

Description A cross-site request forgery issue exists in the pCloud backend's localhost OAuth callback. The system disables the state check and trusts the hostname parameter. This allows malicious web pages to send a stateless request to port 53682 during authorization, enabling the planting of attacker tokens and API hosts, which can cause subsequent data transfers to be routed to the attacker.

Recommendations Update Rclone to version 1.75.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sondt99

Vendors

Affected products

Weakness enumeration

CWE-346: Origin Validation Error

Related identifiers