CVE-2026-116192EUVD-2026-109450GHSA-J48M-MPF8-5CPGGHSA-XQMQ-V4WJ-RW5M
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.74.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- rclone rclone
From 1.37 · fixed in 1.74.2