Vulnerability in rclone

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund25 Oct 2026WID-SEC-2026-4156

  rclone: Multiple vulnerabilities Translated from German

  CVE-2026-116187CVE-2026-116191CVE-2026-116193+7 more CVEs

[ References ]References

• github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8Vendor Advisory
• www.vulncheck.com/advisories/rclone-1.55.0-before-1.75.2-selfupdate-signature-verificat…Third Party Advisory