rclone versions from 1.56.0 up to but not including 1.75.2 have an information disclosure vulnerability in the WebDAV backend. This flaw causes custom credential headers configured by the operator to be forwarded to different hosts during HTTP 3xx redirects. An attacker who can control or influence such redirects may capture sensitive headers like X-Auth-Token and reuse them against the original WebDAV service. The issue is fixed in version 1.75.2.