CVE-2026-116189

HighCVSS 7.5/10Last modified Oct 29, 2026

Description

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
rclone	rclone	>= 1.55.0, < 1.75.2

References

https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8Vendor Advisory
https://www.vulncheck.com/advisories/rclone-1.55.0-before-1.75.2-selfupdate-signature-verification-bypass-via-sha256sumsThird Party Advisory
https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8Vendor Advisory

Timeline

Published: Oct 25, 2026
Last modified: Oct 29, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-116196.3A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/fileman CVE-2026-1161903.7rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured CVE-2026-1161917.5Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served CVE-2026-1161925.9rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http a CVE-2026-1161935.3Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip au CVE-2026-1161946.8Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which CVE-2026-1161956.1Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suff CVE-2026-1161965.3Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE CVE-2026-1161972.6Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wild CVE-2026-1161984.3Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagge CVE-2026-1161998.1Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username CVE-2026-11629.8A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipul