CVE-2026-79779

A flaw was found in rclone. The application fails to reject transport downgrades during redirect handling, which allows Basic authorization and Cookie headers to be replayed over plaintext HTTP following HTTPS-to-HTTP redirects on the same host. An on-path attacker can observe this plaintext...