Improper Verification of Cryptographic Signature in rclone - #VU155810
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code with the invoking user's permissions.
The vulnerability exists due to improper verification of cryptographic signatures in the stable self-update verifier when validating downloaded archive checksums. A remote attacker can prepend an unsigned checksum line to a genuine PGP-clearsigned checksum response and supply a matching malicious archive to execute arbitrary code with the invoking user's permissions.
Exploitation requires control over authenticated responses from the release distribution path; ordinary network interception without a trusted certificate is insufficient. A user must run stable rclone selfupdate without --check, and the replacement executable runs when the updated rclone is subsequently invoked. The PGP private key is not required.