SB2026101511 - Multiple vulnerabilities in rclone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101511

SB2026101511 - Multiple vulnerabilities in rclone

Published: October 15, 2026

Security Bulletin ID SB2026101511
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient restriction of URL authorities in the http backend's named-remote root handling when resolving scheme-relative roots supplied through --rc-serve. A remote attacker can submit a file-serving request containing a crafted named-remote root to direct same-scheme HEAD and GET requests to a selected hostname or IPv4 address and port, receive response bodies, and disclose configured custom headers.

Exploitation requires a reachable listener with --rc-serve enabled, no RC HTTP authentication, --rc-no-auth unset, and knowledge of an existing http remote's name. Header disclosure additionally requires configured custom headers. For HTTPS remotes, the selected endpoint must complete a TLS handshake with a certificate trusted by rclone unless certificate checking is disabled.


2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain time-bound, request-specific authentication signatures for selected paths and actions.

The vulnerability exists due to insufficient restriction of URL authorities in the netstorage backend's named-remote root handling when resolving scheme-relative roots supplied through --rc-serve. A remote attacker can submit a file-serving request containing a crafted named-remote root to direct signed requests to a selected same-scheme endpoint and obtain time-bound, request-specific authentication signatures for selected paths and actions.

Exploitation requires a reachable listener with --rc-serve enabled, no RC HTTP authentication, --rc-no-auth unset, and knowledge of an existing netstorage remote's name. Demonstrated actions are limited to stat and download. Validation used synthetic credentials only; long-term key recovery and unauthorized access to a genuine NetStorage account were not demonstrated.


Remediation

Install update from vendor's website.

References