CVE-2026-116189High· 7.5▾ Twilightrclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
rclone >= 1.55.0 < 1.75.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116193Medium· 5.3Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
CVE-2026-116187Medium· 5.0Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
CVE-2026-116191High· 7.5Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116192Medium· 5.9rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
CVE-2026-116190Low· 3.7rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
CVE-2026-116188Medium· 5.3rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow