CVE-2026-79779
CVE-2026-79779: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.3
Medium [CVE-2026-79779] Credential exposure via HTTPS-to-HTTP redirect downgrade.
CVE-2026-79779Source published Source updated
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions. A flaw was found in rclone. This Moderate impact flaw in rclone allows an on-path attacker to capture credentials by exploiting improper handling of HTTPS-to-HTTP redirects on the same host. Exploitation requires the attacker to be positioned on the network path between the client and the server. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-523. Affected Red Hat products…
- Affected products in this advisory
- Cryostat 4
- Red Hat Advanced Cluster Management for Kubernetes 2
- Source-reported affected versions
- < 75.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Until packages are updated, avoid using rclone WebDAV remotes against servers or gateways that issue HTTPS-to-HTTP redirects. Prefer remotes that remain on HTTPS for the full request path, and do not send Basic authentication or session cookies through intermediaries that can downgrade the TLS connection.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.