SB2026101510 - Multiple vulnerabilities in rclone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101510

SB2026101510 - Multiple vulnerabilities in rclone

Published: October 15, 2026

Security Bulletin ID SB2026101510
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 55% Low 45%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify or disrupt another tenant's in-flight multipart uploads and disclose upload metadata.

The vulnerability exists due to authorization bypass through a user-controlled upload identifier in the rclone S3 server's multipart upload handlers when processing requests across tenants. A remote user can submit another tenant's bucket name, object name, and upload identifier to inject parts into, complete, or abort that tenant's upload, or list uploads and parts to disclose upload metadata.

Exploitation requires a server configured with --auth-proxy and multiple keys mapped to different backends. Modification requires an in-flight victim upload and knowledge of its exact bucket, object, and random UUIDv4 upload identifier. Listing requires a same-named bucket in the caller's backend, but injection, completion, and abortion do not. The destination key remains the one chosen by the initiating tenant; existing object contents are not exposed.


2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose another tenant's custom object metadata.

The vulnerability exists due to insufficient tenant isolation in the rclone S3 server's shared object metadata map when handling object metadata requests. A remote user can issue HeadObject requests to disclose another tenant's custom X-Amz-Meta-* values.

The reported scenario uses one server configured with --auth-proxy and multiple keys mapped to different backends. The disclosure concerns custom object metadata rather than stored object contents.


3) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the waitForTurn multipart reorder-memory accounting in rclone serve s3 when processing concurrent multipart upload requests with oversized declared content lengths. A remote attacker can open two requests for the current part, each declaring 5,000,000,000,000,000,000 bytes while withholding their bodies, and then send out-of-order part bodies that bypass the configured memory limit to cause a denial of service.

Exploitation requires multipart streaming to be enabled. Anonymous exploitation is possible when neither --auth-key nor --auth-proxy is configured; otherwise, an accepted S3 credential is required.


4) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code with the invoking user's permissions.

The vulnerability exists due to improper verification of cryptographic signatures in the stable self-update verifier when validating downloaded archive checksums. A remote attacker can prepend an unsigned checksum line to a genuine PGP-clearsigned checksum response and supply a matching malicious archive to execute arbitrary code with the invoking user's permissions.

Exploitation requires control over authenticated responses from the release distribution path; ordinary network interception without a trusted certificate is insufficient. A user must run stable rclone selfupdate without --check, and the replacement executable runs when the updated rclone is subsequently invoked. The PGP private key is not required.


5) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose custom credential headers to an unintended host.

The vulnerability exists due to insufficient protection of custom credential headers in the WebDAV backend when following cross-host HTTP redirects. A remote attacker can influence the configured server's redirect response to disclose custom credential headers to an unintended host.

Exploitation requires a WebDAV remote configured with a custom credential header through the headers option. The auth_redirect option does not need to be enabled, and the redirect must not downgrade HTTPS to HTTP.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create and overwrite files and directories outside the served root.

The vulnerability exists due to path traversal through an unvalidated '..' path component in rclone's serve webdav implementation when handling MKCOL requests. A remote attacker can send an MKCOL request to /.. followed by crafted write requests through the resulting virtual directory node to create and overwrite files and directories outside the served root.

Exploitation requires a writable served remote with a non-empty root and a backend that joins the root and remote path before encoding path components. Applicable backends include webdav, ftp, sftp, http and memory; local and s3 backends are not affected by this mechanism.


7) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to scheme-insensitive redirect trust validation in rclone's fshttp.Transport when following an HTTPS-to-HTTP redirect that preserves the hostname and numeric port. A remote attacker can observe global --header values transmitted in plaintext on the redirected request to disclose sensitive information.

Exploitation requires a command configured with a sensitive global header and access to observe the plaintext network path or receive the request at the HTTP endpoint. Exposure occurs when the request is written, even if the destination does not return a valid response. The HTTP backend's separate --http-headers option is not affected by this bypass.


8) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper verification of cryptographic signatures in the gofakes3 signature package used by rclone serve s3 when processing SigV4-authenticated PUT requests. A remote user can add an unsigned x-amz-copy-source header to a valid presigned upload request to disclose sensitive information.

Exploitation requires possession of a presigned PUT URL for an object. The copy operation runs with the signer's authority and can access source objects across buckets within the serving key's reach. When serving a cloud remote, the source can be anything the rclone process can reach.


9) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose the existence and type of arbitrary paths in the served remote.

The vulnerability exists due to missing authentication in the basicAuth() and MiddlewareAuthCustom() functions in lib/http/middleware.go when handling OPTIONS requests to rclone serve webdav. A remote attacker can send unauthenticated OPTIONS requests for candidate paths and inspect differences in the Allow response header to disclose the existence and type of arbitrary paths in the served remote.

Deployments using --user/--pass, --htpasswd, or --auth-proxy are affected. Exposure is limited to metadata; OPTIONS requests do not expose file contents or directory listings and do not permit writes.


10) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose transferred files and substitute downloaded content.

The vulnerability exists due to missing cross-site request forgery protection in the pcloud backend's localhost OAuth callback when processing authorization callbacks without a state parameter. A remote attacker can send a cross-site callback containing an attacker-supplied authorization code and API hostname, leveraging the callback's trust in that hostname to disclose transferred files and substitute downloaded content.

A malicious page must be loaded in the victim's browser while the victim is running rclone config or rclone authorize pcloud. The callback server listens on 127.0.0.1:53682.


11) Origin validation error (CVE-ID: N/A)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose transferred files and substitute downloaded content.

The vulnerability exists due to improper origin validation in the pcloud backend's checkAuth callback handler when processing the callback-supplied hostname parameter. A remote attacker can supply an attacker-controlled API hostname that is persisted in the remote configuration and used for token exchange and subsequent transfers to disclose transferred files and substitute downloaded content.

The documented attack depends on the missing OAuth state check accepting a cross-site callback. A malicious page must be loaded in the victim's browser during rclone config or rclone authorize pcloud.


Remediation

Install update from vendor's website.

References