Live › vulnerability › CVE-2026-116189
Go to dashboardrclone's stable selfupdate accepts checksum lines placed before the PGP-signed SHA256SUMS block, so the signature check does not cover them. An attacker who controls the release distribution path can make selfupdate install a malicious rclone executable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone binaries installed via its built-in selfupdate on the stable channel, from versions 1.55.0 through 1.75.1. Exposure depends on the attacker controlling the release distribution path, so systems installed from OS packages or pinned images that never self-update are less exposed.
No product ranges from the sources yet.
rclone version and confirm the installed version is below 1.75.2.rclone selfupdate (stable channel).1.75.2 or later.rclone selfupdate and reinstall from a trusted package manager or verified release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
This page as .md · .json · in your agent: get_signal("CVE-2026-116189")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.