Rclone vulnerabilities
42 CVEs and advisories name Rclone as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116196Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
- CVE-2026-116195Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
- CVE-2026-116194Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
- CVE-2026-116193Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
- CVE-2026-116192rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- CVE-2026-116191Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
- CVE-2026-116190rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
- CVE-2026-116189rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
- CVE-2026-116188rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
- CVE-2026-116187Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
- CVE-2026-93987rclone serve docker Path Traversal via Volume Name
- CVE-2026-93986rclone before 1.75.1 Path Traversal via Directory Listing Names
- CVE-2026-88046rclone: source object names can escape the configured root on upload
- CVE-2026-88045rclone: S3 multipart declared-length memory exhaustion
- CVE-2026-88044rclone: RC per-server auth-proxy bypass
- CVE-2026-88018rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-88017rclone: FTP cross-session auth-proxy backend confusion
- CVE-2026-88016rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- CVE-2026-88015rclone local: crafted Range request against a translated symlink panics (DoS)
- CVE-2026-88014rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
- CVE-2026-88013rclone: http backend forwards custom/auth headers to a different host on redirect
- CVE-2026-79783rclone before 1.74.4 Privilege Escalation via setuid Metadata
- CVE-2026-79782rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
- CVE-2026-79781rclone serve s3 Path Traversal via dot-dot object keys
- CVE-2026-79780rclone before v1.75.0 Credential Exposure via S3 Redirect
- CVE-2026-79779rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
- CVE-2026-79778rclone before v1.75.0 Denial of Service via TUS nil-response panic
- CVE-2026-79777rclone before v1.75.0 Information Disclosure via RC API
- CVE-2026-79776rclone before 1.75.0 Authentication Bypass via pprof
- CVE-2026-79775rclone Archive Backend SquashFS Parser Denial of Service