CVE-2026-116196

Rclone versions prior to v1.75.2 are vulnerable to a credential exposure flaw in the b2 backend . When using the --b2-download-url option, the application may leak live account Authorization tokens and SSE-C keys during HTTP redirects. Specifically, attackers can capture cleartext B2 tokens via s...

EUVD-2026-109454

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...