CVE-2026-116192: rclone rclone

CVSS 8.2 (high) · published 2026-10-25

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

Affected products (NVD): rclone rclone

Fixed in (NVD): 1.74.2

Weakness: CWE-918

Source: NVD CVE-2026-116192

References

• https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m
• https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots
• https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.