CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

The i18next-http-backend library, used for loading translation resources in Node.js , browsers , and Deno , is vulnerable to Server-Side Request Forgery (SSRF) and URL injection prior to version 4.0.2 . The root cause is incomplete URL validation where attacker-controlled language or namespace va...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

PT-2026-95838

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...

CVE-2026-88013

A flaw was found in rclone. The HTTP backend in rclone can forward custom or authentication headers, such as API keys, Authorization, or Cookie headers, when following redirects to a different host. This can lead to the disclosure of sensitive information to untrusted destinations. Additionally, ...

GHSA-486V-Q2WF-FP2R rclone: http backend forwards custom/auth headers to a different host on redirect

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

rclone: http backend forwards custom/auth headers to a different host on redirect

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

CVE-2026-88013

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

EUVD-2026-75567

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-88013: Exposure of Sensitive Information to an Unauthorized Actor

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

PT-2026-89474

Name of the Vulnerable Software and Affected Versions rclone versions 1.49.0 through 1.75.0 Description The HTTP backend in rclone fails to implement a specific http.Client.CheckRedirect policy when using the fshttp.NewClient client in backend/http/http.go. This causes the application to follow t...

PT-2026-89683

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

CVE-2026-88013: Exposure of Sensitive Information to an Unauthorized Actor

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...