What’s Vulnerable › Vulnerabilities
CVE-2026-116192: rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-25 · updated 2026-10-27
- Weakness: CWE-918
Description
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
Affected products
How to fix
Upgrade to a fixed version: rclone 1.74.2; rclone 1.74.2. Check the vendor advisory for mitigations.
References
- https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m
- https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots
Get alerted when CVE-2026-116192 or the next vulnerability affects your stack