# cve.now: Rclone

The newest entries naming Rclone as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116196](https://cve.now/CVE-2026-116196.md): Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url (CVSS 6.0)
- [CVE-2026-116195](https://cve.now/CVE-2026-116195.md): Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim (CVSS 7.0)
- [CVE-2026-116194](https://cve.now/CVE-2026-116194.md): Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback (CVSS 7.6)
- [CVE-2026-116193](https://cve.now/CVE-2026-116193.md): Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests (CVSS 6.9)
- [CVE-2026-116192](https://cve.now/CVE-2026-116192.md): rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots (CVSS 8.2)
- [CVE-2026-116191](https://cve.now/CVE-2026-116191.md): Rclone before 1.75.2 Path Traversal via serve webdav MKCOL (CVSS 8.7)
- [CVE-2026-116190](https://cve.now/CVE-2026-116190.md): rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect (CVSS 6.3)
- [CVE-2026-116189](https://cve.now/CVE-2026-116189.md): rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS (CVSS 7.7)
- [CVE-2026-116188](https://cve.now/CVE-2026-116188.md): rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow (CVSS 6.9)
- [CVE-2026-116187](https://cve.now/CVE-2026-116187.md): Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads (CVSS 6.1)
- [CVE-2026-93987](https://cve.now/CVE-2026-93987.md): rclone serve docker Path Traversal via Volume Name (CVSS 4.6)
- [CVE-2026-93986](https://cve.now/CVE-2026-93986.md): rclone before 1.75.1 Path Traversal via Directory Listing Names (CVSS 2.3)
- [CVE-2026-88046](https://cve.now/CVE-2026-88046.md): rclone: source object names can escape the configured root on upload (CVSS 5.3)
- [CVE-2026-88045](https://cve.now/CVE-2026-88045.md): rclone: S3 multipart declared-length memory exhaustion (CVSS 7.5)
- [CVE-2026-88044](https://cve.now/CVE-2026-88044.md): rclone: RC per-server auth-proxy bypass (CVSS 9.1)
- [CVE-2026-88018](https://cve.now/CVE-2026-88018.md): rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass (CVSS 9.8)
- [CVE-2026-88017](https://cve.now/CVE-2026-88017.md): rclone: FTP cross-session auth-proxy backend confusion (CVSS 7.3)
- [CVE-2026-88016](https://cve.now/CVE-2026-88016.md): rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination (CVSS 7.1)
- [CVE-2026-88015](https://cve.now/CVE-2026-88015.md): rclone local: crafted Range request against a translated symlink panics (DoS) (CVSS 5.3)
- [CVE-2026-88014](https://cve.now/CVE-2026-88014.md): rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace (CVSS 6.3)
- [CVE-2026-88013](https://cve.now/CVE-2026-88013.md): rclone: http backend forwards custom/auth headers to a different host on redirect (CVSS 3.7)
- [CVE-2026-79783](https://cve.now/CVE-2026-79783.md): rclone before 1.74.4 Privilege Escalation via setuid Metadata (CVSS 2.0)
- [CVE-2026-79782](https://cve.now/CVE-2026-79782.md): rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect (CVSS 9.3)
- [CVE-2026-79781](https://cve.now/CVE-2026-79781.md): rclone serve s3 Path Traversal via dot-dot object keys (CVSS 6.9)
- [CVE-2026-79780](https://cve.now/CVE-2026-79780.md): rclone before v1.75.0 Credential Exposure via S3 Redirect (CVSS 6.0)
- [CVE-2026-79779](https://cve.now/CVE-2026-79779.md): rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect (CVSS 6.0)
- [CVE-2026-79778](https://cve.now/CVE-2026-79778.md): rclone before v1.75.0 Denial of Service via TUS nil-response panic (CVSS 6.0)
- [CVE-2026-79777](https://cve.now/CVE-2026-79777.md): rclone before v1.75.0 Information Disclosure via RC API (CVSS 5.1)
- [CVE-2026-79776](https://cve.now/CVE-2026-79776.md): rclone before 1.75.0 Authentication Bypass via pprof (CVSS 6.9)
- [CVE-2026-79775](https://cve.now/CVE-2026-79775.md): rclone Archive Backend SquashFS Parser Denial of Service (CVSS 7.1)
- [CVE-2026-71313](https://cve.now/CVE-2026-71313.md): rclone: Local Encoding Path Traversal (CVSS 6.9)
- [CVE-2026-71312](https://cve.now/CVE-2026-71312.md): rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution (CVSS 8.0)
- [CVE-2026-71311](https://cve.now/CVE-2026-71311.md): rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines (CVSS 6.4)
- [CVE-2026-71310](https://cve.now/CVE-2026-71310.md): rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory (CVSS 5.9)
- [CVE-2026-71309](https://cve.now/CVE-2026-71309.md): rclone: Incomplete path validation allows backend root escape in serve restic (CVSS 8.6)
- [CVE-2026-59733](https://cve.now/CVE-2026-59733.md): rclone \`serve restic --private-repos\` authorization bypass: \`..\` in the URL path lets an authenticated user read, overwrite and delete other users' repositories (CVSS 8.8)
- [CVE-2026-54572](https://cve.now/CVE-2026-54572.md): rclone: Unvalidated symlink target in local \`--links\` — arbitrary file write from an untrusted remote (CVSS 7.5)
- [CVE-2026-59732](https://cve.now/CVE-2026-59732.md): rclone archive extract allows S3 destination prefix escape via crafted archive paths (CVSS 5.0)
- [CVE-2026-49980](https://cve.now/CVE-2026-49980.md): Rclone: Unauthenticated command execution in \`rclone rcd --rc-serve\` via inline remote instantiation, bypassing CVE-2026-41179 fix (CVSS 9.8)
- [CVE-2026-41179](https://cve.now/CVE-2026-41179.md): RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution (CVSS 9.2)
- [CVE-2026-41176](https://cve.now/CVE-2026-41176.md): Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution (CVSS 9.2)
- [CVE-2024-52522](https://cve.now/CVE-2024-52522.md): Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/rclone
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.