CVE-2026-116194

MEDIUM 6.8

Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.

CWE	CWE-346
Vendor	rclone
Product	rclone
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new medium vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

rclone / rclone

1.52.0 < 1.75.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46 vulncheck.com: https://www.vulncheck.com/advisories/rclone-1.52.0-before-1.75.2-csrf-via-pcloud-oauth-callback

Credits

🔍 sondt99 ncw