{"vulnerability": "ghsa-h4mf-4v27-hggj", "sightings": [{"uuid": "8154170c-afd3-4296-bd57-3b79e851ddf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "ghsa-h4mf-4v27-hggj", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mskm3mosqt2l", "content": "rclone's WebDAV backend leaked credentials over cleartext HTTP via HTTPS-to-HTTP redirects on the same host. CVSS 7.4 \u2014 upgrade to\u2026\n\nhttps://dev.to/cverports/ghsa-h4mf-4v27-hggj-ghsa-h4mf-4v27-hggj-webdav-credential-disclosure-via-same-host-https-to-http-4adg\n\n#appsec #DevSecOps", "creation_timestamp": "2026-08-08T08:00:20.728857Z"}, {"uuid": "472374ed-90a8-4674-81ba-4548789b142b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-H4MF-4V27-HGGJ", "type": "seen", "source": "https://gist.github.com/alon710/16a5e6da3d279fedecbd3519f100eaf1", "content": "# GHSA-H4MF-4V27-HGGJ: GHSA-H4MF-4V27-HGGJ: WebDAV Credential Disclosure via Same-Host HTTPS-to-HTTP Redirect in rclone\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/GHSA-H4MF-4V27-HGGJ\n\n## Summary\nA protocol downgrade vulnerability in rclone's WebDAV backend allows sensitive credentials, cookies, and authentication headers to be transmitted in cleartext. This occurs when a remote server redirects an HTTPS request to a plaintext HTTP URL on the same host, which the Go HTTP client default behavior permits without checking the protocol transport layer. This report provides a detailed technical analysis of the root cause, exploit mechanics, patch diff, and remediation strategies.\n\n## TL;DR\nrclone's WebDAV backend leaked sensitive credentials over cleartext HTTP during same-host HTTPS-to-HTTP redirects due to missing protocol scheme validation in its redirection handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-319 / CWE-200\n- **Attack Vector**: Network (Adversary-in-the-Middle)\n- **CVSS v3.1**: 7.4 (High)\n- **Exploit Status**: Proof of Concept (PoC) in regression tests\n- **KEV Status**: Not Listed\n- **Remediation**: Upgrade to v1.75.0 or disable auth_redirect\n\n## Affected Systems\n\n- rclone WebDAV Backend\n- **rclone**: < 1.75.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone installations to version v1.75.0 or higher\n- Disable the advanced configuration parameter auth_redirect\n- Implement network-level egress filtering to block unexpected plaintext HTTP traffic to known cloud endpoints\n\n**Remediation Steps:**\n1. Locate all active installations of rclone within the infrastructure.\n2. Execute 'rclone version' to identify vulnerable deployments running versions prior to v1.75.0.\n3. Apply the v1.75.0 upgrade package via the official package manager or by downloading the binary directly from rclone's release archive.\n4. Inspect configuration files (rclone.conf) for WebDAV targets and confirm that 'auth_redirect' is not set to true.\n5. Establish monitoring rules on the perimeter network to inspect any cleartext HTTP headers targeting corporate WebDAV servers.\n\n## References\n\n- [GHSA-H4MF-4V27-HGGJ: rclone WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect](https://github.com/advisories/GHSA-H4MF-4V27-HGGJ)\n- [Fix Patch Commit](https://github.com/rclone/rclone/commit/59b513b0e74fd2943ccbb8891d5ce00f860e6d26)\n- [rclone v1.75.0 Release Details](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-H4MF-4V27-HGGJ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T11:31:09.500481Z"}]}