Skip to content
Rclone vulnerabilities
Newest
-
rclone
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
CVE-2026-116196
Fix available
6.0 Medium
-
rclone
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
CVE-2026-116195
Fix available
7.0 High
-
rclone
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
CVE-2026-116194
Fix available
7.6 High
-
rclone
Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
CVE-2026-116193
Fix available
6.9 Medium
-
rclone
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
CVE-2026-116192
Fix available
8.2 High
-
rclone
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116191
Public exploitFix available
8.7 High
-
rclone
rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
CVE-2026-116190
Fix available
6.3 Medium
-
rclone
rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
CVE-2026-116189
Fix available
7.7 High
-
rclone
rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
CVE-2026-116188
Fix available
6.9 Medium
-
rclone
Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
CVE-2026-116187
Fix available
6.1 Medium
-
rclone
rclone serve docker Path Traversal via Volume Name
CVE-2026-93987
Fix available
4.6 Medium
-
rclone
rclone before 1.75.1 Path Traversal via Directory Listing Names
CVE-2026-93986
Fix available
2.3 Low
-
rclone
rclone: source object names can escape the configured root on upload
CVE-2026-88046
Fix available
5.3 Medium
-
rclone
rclone: S3 multipart declared-length memory exhaustion
CVE-2026-88045
Fix available
7.5 High
-
rclone
rclone: RC per-server auth-proxy bypass
CVE-2026-88044
Fix available
9.1 Critical
-
rclone
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
CVE-2026-88018
Fix available
9.8 Critical
-
rclone
rclone: FTP cross-session auth-proxy backend confusion
CVE-2026-88017
Fix available
7.3 High
-
rclone
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
CVE-2026-88016
Fix available
7.1 High
-
rclone
rclone local: crafted Range request against a translated symlink panics (DoS)
CVE-2026-88015
Fix available
5.3 Medium
-
rclone
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
CVE-2026-88014
Fix available
6.3 Medium
-
rclone
rclone: http backend forwards custom/auth headers to a different host on redirect
CVE-2026-88013
Fix available
3.7 Low
-
rclone
rclone before 1.75.0 Authentication Bypass via pprof
CVE-2026-79776
Fix available
6.9 Medium
-
rclone
rclone Archive Backend SquashFS Parser Denial of Service
CVE-2026-79775
Fix available
7.1 High
-
rclone
rclone: Local Encoding Path Traversal
CVE-2026-71313
Fix available
6.9 Medium
-
rclone
rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
CVE-2026-79782
Fix available
9.3 Critical
-
rclone
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
CVE-2026-71312
Fix available
8.0 High
-
rclone
rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
CVE-2026-79779
Fix available
6.0 Medium
-
rclone
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
CVE-2026-71311
Fix available
6.4 Medium
-
rclone
rclone before v1.75.0 Credential Exposure via S3 Redirect
CVE-2026-79780
Fix available
6.0 Medium
-
rclone
rclone serve s3 Path Traversal via dot-dot object keys
CVE-2026-79781
Fix available
6.9 Medium
-
rclone
rclone before v1.75.0 Denial of Service via TUS nil-response panic
CVE-2026-79778
Fix available
6.0 Medium
-
rclone
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
CVE-2026-71310
Fix available
5.9 Medium
-
rclone
rclone: Incomplete path validation allows backend root escape in serve restic
CVE-2026-71309
Fix available
8.6 High
-
rclone
rclone before 1.74.4 Privilege Escalation via setuid Metadata
CVE-2026-79783
Fix available
2.0 Low
-
rclone
rclone before v1.75.0 Information Disclosure via RC API
CVE-2026-79777
Fix available
5.1 Medium
-
rclone
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
CVE-2026-59733
Fix available
8.8 High
-
rclone
rclone archive extract allows S3 destination prefix escape via crafted archive paths
CVE-2026-59732
Fix available
5.0 Medium
-
rclone
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
CVE-2026-54572
Fix available
7.5 High
-
rclone, red hat cryostat 4, openshift api for data protection +1 more +3 more
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
CVE-2026-49980
Fix available
9.8 Critical
-
rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 more
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
CVE-2026-41179
Public exploitFix available
9.2 Critical
-
rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 more
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
CVE-2026-41176
Fix available
EPSS 32.7%
9.2 Critical
-
rclone
Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
CVE-2024-52522
Fix available
5.4 Medium
-
rclone, fedoraproject fedora +1 more
Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone
CVE-2020-28924
Fix available
7.5 High
-
rclone
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets...
CVE-2018-12907
7.5 High