Server-Side Request Forgery (SSRF) in rclone - #VU155815
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to obtain time-bound, request-specific authentication signatures for selected paths and actions.
The vulnerability exists due to insufficient restriction of URL authorities in the netstorage backend's named-remote root handling when resolving scheme-relative roots supplied through --rc-serve. A remote attacker can submit a file-serving request containing a crafted named-remote root to direct signed requests to a selected same-scheme endpoint and obtain time-bound, request-specific authentication signatures for selected paths and actions.
Exploitation requires a reachable listener with --rc-serve enabled, no RC HTTP authentication, --rc-no-auth unset, and knowledge of an existing netstorage remote's name. Demonstrated actions are limited to stat and download. Validation used synthetic credentials only; long-term key recovery and unauthorized access to a genuine NetStorage account were not demonstrated.