{"id":"CVE-2026-116187","kind":"vulnerability","aliases":["CVE-2026-116187"],"related":[],"title":"Rclone: S3 auth proxy lets tenants touch other tenants' multipart uploads","description":"Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.","summary":"Rclone's serve s3 --auth-proxy mode does not check that a multipart upload ID belongs to the requesting tenant. An authenticated tenant who learns another tenant's bucket, object and upload ID can add parts, complete or abort that upload, and read upload and object metadata.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","package","rclone","s3","self-hosted"],"not_affected_if":["default-config","single-tenant"],"how_to_check":"- Run `rclone version` and confirm the installed version is below `v1.75.2`\n- Check whether the service is started with `serve s3` and `--auth-proxy` (for example in the process list or service unit)","fix":"- Upgrade rclone to `v1.75.2` or later\n- Until upgraded, stop exposing `serve s3 --auth-proxy` to tenants you do not fully trust","status":"open","published_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:54+00:00","updated_at":"2026-10-25T14:42:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade rclone to `v1.75.2` or later\n- Until upgraded, stop exposing `serve s3 --auth-proxy` to tenants you do not fully trust","reach":"network","title":"Rclone: S3 auth proxy lets tenants touch other tenants' multipart uploads","impact":"medium","summary":"Rclone's serve s3 --auth-proxy mode does not check that a multipart upload ID belongs to the requesting tenant. An authenticated tenant who learns another tenant's bucket, object and upload ID can add parts, complete or abort that upload, and read upload and object metadata.","category":"package","nicknames":[],"who_cares":["rclone","self-hosted","s3","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Another tenant's in-flight uploads get injected, completed, or aborted","analyst_note":"","how_to_check":"- Run `rclone version` and confirm the installed version is below `v1.75.2`\n- Check whether the service is started with `serve s3` and `--auth-proxy` (for example in the process list or service unit)","needs_analyst":false,"not_affected_if":["single-tenant","default-config"],"who_is_affected":"Teams that run rclone's S3 server with the --auth-proxy option so several tenants share one endpoint. A single-user rclone install or a plain serve s3 without an auth proxy is not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3368,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116187':14A,17A '-2026':13A,16A 'abort':66B,122C 'across':133C 'add':62B 'allow':92C 'anoth':53B 'attack':106C 'auth':3A,32B,89C 'auth-proxi':31B,88C 'authent':49B,93C 'author':82C 'belong':43B 'bucket':56B,112C 'bypass':83C 'check':37B 'complet':64B,120C 'contain':80C 'cve':12A,15A 'flight':125C 'host':26B 'id':42B,60B,105C,116C 'in-flight':123C 'inject':118C 'learn':52B,108C 'let':5A 'manipul':96C 'metadata':74B,132C 'mode':34B 'multi':19B 'multi-ten':18B 'multipart':10A,40B,99C 'object':57B,73B,113C,131C 'packag':21B 'part':63B,119C 'proxi':4A,33B,90C 'rclone':1A,22B,27B,75C 'read':70B 'referenc':102C 'request':46B 's3':2A,23B,30B,87C 'self':25B 'self-host':24B 'serv':29B,86C 'tenant':6A,9A,20B,47B,50B,54B,94C,98C,134C 'touch':7A 'upload':11A,41B,59B,68B,71B,100C,104C,115C,126C,129C 'v1.68.0':77C 'v1.75.2':79C 'victim':110C 'view':128C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams that run rclone's S3 server with the --auth-proxy option so several tenants share one endpoint. A single-user rclone install or a plain serve s3 without an auth proxy is not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116187","severity":null,"published_at":"2026-10-25T14:16:58+00:00","modified_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}