[ CVE-2026-116187 · Published 25 Oct 2026 ]

Vulnerability in rclone

CVSS 5.0 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund25 Oct 2026WID-SEC-2026-4156

rclone: Multiple vulnerabilities Translated from German
CVE-2026-116187CVE-2026-116191CVE-2026-116193+7 more CVEs

[ References ]References

github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5Vendor Advisory
www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-serve-…Third Party Advisory

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

rclone: Multiple vulnerabilities Translated from German

[ References ]References