{"id":"CVE-2026-116196","title":"github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend (CVE-2026-116196)","summary":"A flaw was found in Rclone. This vulnerability allows information disclosure due to improper handling of HTTP redirects within the Backblaze B2 storage backend. When download requests are redirected, the client inadvertently forwards sensi…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-201","CWE-319"],"vendor":"Red Hat","product":"Cryostat 4","affected":["cryostat 4","advanced_cluster_management_for_kubernetes 2"],"published":"2026-10-25","updated":"2026-10-26","sourceUpdated":"2026-10-26T07:07:28+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116196.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116196.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116196"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560422"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116196"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116196"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72"},{"url":"https://www.vulncheck.com/advisories/rclone-before-1.75.2-b2-credential-leak-on-redirect-via-b2-download-url"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-25T22:08:29.942Z","epss":0.00063,"epssPercentile":0.0001,"slug":"CVE-2026-116196","body":"## Overview\n\nA flaw was found in Rclone. This vulnerability allows information disclosure due to improper handling of HTTP redirects within the Backblaze B2 storage backend. When download requests are redirected, the client inadvertently forwards sensitive account authorization tokens and Server-Side Encryption with Customer-Provided Keys (SSE-C). An attacker positioned on an adjacent network or controlling a redirect destination can intercept these credentials to gain unauthorized access to protected cloud storage resources.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116196.json)\n\n**github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend** — rated Moderate by Red Hat. Released 2026-10-25, updated 2026-10-26.\n\nAffected:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}