[ Vendor · 10 CVEs ]
rclone
CVEs affecting rclone published in the last 30 days, plus any rclone CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-116196 | 25 Oct 2026 | CVSS 5.3 | rcloneRclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys… | |
| CVE-2026-116189 | 25 Oct 2026 | CVSS 7.5 | rclonerclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding… | |
| CVE-2026-116190 | 25 Oct 2026 | CVSS 3.7 | rclonerclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom… | |
| CVE-2026-116191 | 25 Oct 2026 | CVSS 7.5 | rcloneRclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by… | |
| CVE-2026-116192 | 25 Oct 2026 | CVSS 5.9 | rclonerclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and… | |
| CVE-2026-116193 | 25 Oct 2026 | CVSS 5.3 | rcloneRclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip… | |
| CVE-2026-116194 | 25 Oct 2026 | CVSS 6.8 | rcloneRclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables… | |
| CVE-2026-116195 | 25 Oct 2026 | CVSS 6.1 | rcloneRclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a… | |
| CVE-2026-116187 | 25 Oct 2026 | CVSS 5.0 | rcloneRclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to… | |
| CVE-2026-116188 | 25 Oct 2026 | CVSS 5.3 | rclonerclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the… |