What’s Vulnerable › Vulnerabilities

CVE-2026-116187: Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-25 · updated 2026-10-28
• Weakness: CWE-639

Description

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

Affected products

• rclone: from 1.68.0 before 1.75.2 — fixed in 1.75.2
• rclone: from 1.68.0 before 1.75.2 — fixed in 1.75.2

How to fix

Upgrade to a fixed version: rclone 1.75.2; rclone 1.75.2. Check the vendor advisory for mitigations.

References

• https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5
• https://www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-serve-s3-multipart-uploads

Get alerted when CVE-2026-116187 or the next vulnerability affects your stack