CVE-2026-116194
Description
A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state and improperly trusts external host parameters. By tricking a user into visiting a malicious webpage during the authorization process, an attacker can inject rogue access tokens and endpoints, causing subsequent file transfers to reach an attacker-controlled server.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires a user to initiate an interactive authentication flow for the pCloud backend while concurrently navigating to a malicious website capable of reaching the local authorization port. Within Red Hat environments, including Red Hat Advanced Cluster Management for Kubernetes and Cryostat, rclone functions primarily within non-interactive containerized workloads using preconfigured credentials. As a result, standard deployments that do not execute interactive authorization routines or utilize pCloud integration are not exposed to this issue during normal operation.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
