{"id":"CVE-2026-116194","title":"github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)","summary":"A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentica…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"vendor","cwe":"CWE-346","vendor":"Red Hat","product":"Cryostat 4","affected":["cryostat 4","advanced_cluster_management_for_kubernetes 2"],"published":"2026-10-25","updated":"2026-10-26","sourceUpdated":"2026-10-26T07:07:25+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116194.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116194.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116194"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560440"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116194"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116194"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46"},{"url":"https://www.vulncheck.com/advisories/rclone-1.52.0-before-1.75.2-csrf-via-pcloud-oauth-callback"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-25T22:08:29.942Z","epss":0.0012,"epssPercentile":0.01788,"slug":"CVE-2026-116194","body":"## Overview\n\nA flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state and improperly trusts external host parameters. By tricking a user into visiting a malicious webpage during the authorization process, an attacker can inject rogue access tokens and endpoints, causing subsequent file transfers to reach an attacker-controlled server.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116194.json)\n\n**github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback** — rated Moderate by Red Hat. Released 2026-10-25, updated 2026-10-26.\n\nAffected:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}