Authorization bypass through user-controlled key in rclone - #VU155807
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote user to modify or disrupt another tenant's in-flight multipart uploads and disclose upload metadata.
The vulnerability exists due to authorization bypass through a user-controlled upload identifier in the rclone S3 server's multipart upload handlers when processing requests across tenants. A remote user can submit another tenant's bucket name, object name, and upload identifier to inject parts into, complete, or abort that tenant's upload, or list uploads and parts to disclose upload metadata.
Exploitation requires a server configured with --auth-proxy and multiple keys mapped to different backends. Modification requires an in-flight victim upload and knowledge of its exact bucket, object, and random UUIDv4 upload identifier. Listing requires a same-named bucket in the caller's backend, but injection, completion, and abortion do not. The destination key remains the one chosen by the initiating tenant; existing object contents are not exposed.