rclone versions from 1.37 up to but not including 1.74.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to redirect HTTP and NetStorage backend requests by supplying a double-slash root on an existing named remote via the --rc-serve option. Exploitation enables attackers to make HEAD or GET requests to attacker-controlled hosts, potentially reading responses, capturing configured custom headers, or obtaining valid NetStorage request signatures. The vulnerability is fixed in version 1.74.2.