{"action":"Upgrade github.com/rclone/rclone to 1.75.1 or later.","affected":[{"fixed":"1.75.1","introduced":"1.49.0"}],"component":"github.com/rclone/rclone","cve_ids":["CVE-2026-88013"],"ecosystem":"Go","epss":0.00187,"exploited":false,"fixed_versions":["1.75.1"],"ghsa_id":"GHSA-486v-q2wf-fp2r","id":"tcs_01M5KEW5WCV3C0BCF5VP7986GF","modified_at":"2026-09-19T09:25:46.964765936Z","published_at":"2026-09-10T23:02:53Z","references":["https://osv.dev/vulnerability/GHSA-486v-q2wf-fp2r","https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r","https://nvd.nist.gov/vuln/detail/CVE-2026-88013","https://github.com/rclone/rclone/commit/22859b7e696cea3c563c6ba04c6b7f91f74456b4","https://github.com/rclone/rclone/commit/79fbc0842f74e02cb84f0e3e7261d169983c8831","https://github.com/rclone/rclone/commit/925fb4fb21eb25e75cd1b64fdd17ded857784bfc","https://github.com/rclone/rclone","https://github.com/rclone/rclone/releases/tag/v1.75.1"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-486v-q2wf-fp2r","url":"https://osv.dev/vulnerability/GHSA-486v-q2wf-fp2r"}],"summary":"rclone: http backend forwards custom/auth headers to a different host on redirect"}