Information disclosure in rclone - #VU155808
Published: October 15, 2026
Vulnerability identifier: #VU155808
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose another tenant's custom object metadata.
The vulnerability exists due to insufficient tenant isolation in the rclone S3 server's shared object metadata map when handling object metadata requests. A remote user can issue HeadObject requests to disclose another tenant's custom X-Amz-Meta-* values.
The reported scenario uses one server configured with --auth-proxy and multiple keys mapped to different backends. The disclosure concerns custom object metadata rather than stored object contents.
Affected software
rclone
Remediation
Install security update from vendor's website.
rclone - update to 1.75.2