github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)

Overview

A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state and improperly trusts external host parameters. By tricking a user into visiting a malicious webpage during the authorization process, an attacker can inject rogue access tokens and endpoints, causing subsequent file transfers to reach an attacker-controlled server.

Vendor advisories

• Red Hat VEX · Moderate · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · vex

github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback — rated Moderate by Red Hat. Released 2026-10-25, updated 2026-10-26.

Affected:

• Cryostat 4
• Red Hat Advanced Cluster Management for Kubernetes 2

No fix planned:

• Cryostat 4
• Red Hat Advanced Cluster Management for Kubernetes 2

Remediation

Fix deferred

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.