github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)

Overview

A flaw was found in rclone. When interacting with WebDAV storage services, rclone inadvertently forwards user-configured custom credential headers to external destinations across HTTP redirects. A remote attacker who controls or influences a target redirect server could intercept sensitive authentication headers and reuse them against the legitimate service, resulting in information disclosure.

Vendor advisories

• Red Hat VEX · Low · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · vex

github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects — rated Low by Red Hat. Released 2026-10-25, updated 2026-10-26.

Affected:

• Cryostat 4
• Red Hat Advanced Cluster Management for Kubernetes 2

No fix planned:

• Cryostat 4
• Red Hat Advanced Cluster Management for Kubernetes 2

Remediation

Fix deferred

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.