{"id":"CVE-2026-116189","kind":"vulnerability","aliases":["CVE-2026-116189"],"related":[],"title":"rclone: self-update trusts unsigned checksums, installing attacker-supplied binaries","description":"rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.","summary":"rclone's stable selfupdate accepts checksum lines placed before the PGP-signed SHA256SUMS block, so the signature check does not cover them. An attacker who controls the release distribution path can make selfupdate install a malicious rclone executable.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","package","rclone","self-hosted","windows"],"not_affected_if":["no-selfupdate","package-manager-install","pinned-version"],"how_to_check":"- Run `rclone version` and confirm the installed version is below `1.75.2`.\n- Check whether the install was made or updated with `rclone selfupdate` (stable channel).","fix":"- Upgrade rclone to `1.75.2` or later.\n- Until upgraded, avoid running `rclone selfupdate` and reinstall from a trusted package manager or verified release.","status":"open","published_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:31+00:00","updated_at":"2026-10-25T14:42:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade rclone to `1.75.2` or later.\n- Until upgraded, avoid running `rclone selfupdate` and reinstall from a trusted package manager or verified release.","reach":"internet","title":"rclone: self-update trusts unsigned checksums, installing attacker-supplied binaries","impact":"high","summary":"rclone's stable selfupdate accepts checksum lines placed before the PGP-signed SHA256SUMS block, so the signature check does not cover them. An attacker who controls the release distribution path can make selfupdate install a malicious rclone executable.","category":"package","nicknames":[],"who_cares":["rclone","self-hosted","linux","macos","windows"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker-controlled rclone executable installed and run on the host.","analyst_note":"Confirm the affected version range and fixed release against the rclone changelog or GitHub advisory, since sources here are NVD only.","how_to_check":"- Run `rclone version` and confirm the installed version is below `1.75.2`.\n- Check whether the install was made or updated with `rclone selfupdate` (stable channel).","needs_analyst":true,"not_affected_if":["package-manager-install","no-selfupdate","pinned-version"],"who_is_affected":"Teams that run rclone binaries installed via its built-in selfupdate on the stable channel, from versions 1.55.0 through 1.75.1. Exposure depends on the attacker controlling the release distribution path, so systems installed from OS packages or pinned images that never self-update are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3357,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116189':15A,18A '-2026':14A,17A '1.55.0':68C '1.75.2':70C 'accept':31B 'archiv':107C 'attack':10A,51B,92C,114C 'attacker-control':113C 'attacker-suppli':9A 'binari':12A 'block':41B,91C 'bypass':75C 'byte':84C 'caus':108C 'check':45B 'checksum':7A,32B,81C,102C 'clearsign':89C 'contain':71C 'control':53B,93C,115C 'cover':48B 'cve':13A,16A 'distribut':56B,96C 'execut':65B,117C 'host':25B 'instal':8A,61B,111C 'line':33B,103C 'linux':19B 'maco':20B 'make':59B 'malici':63B,106C 'match':104C 'packag':21B 'path':57B,97C 'pgp':38B,88C 'pgp-clearsign':87C 'pgp-sign':37B 'place':34B 'preced':85C 'prepend':99C 'rclone':1A,22B,27B,64B,66C,116C 'releas':55B,95C 'self':3A,24B 'self-host':23B 'self-upd':2A 'selfupd':30B,60B,78C,109C 'sha256sums':40B,90C 'sign':39B 'signatur':44B,73C 'stabl':29B,77C 'suppli':11A 'trust':5A,80C 'unsign':6A,83C,101C 'updat':4A 'verif':74C 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Teams that run rclone binaries installed via its built-in selfupdate on the stable channel, from versions 1.55.0 through 1.75.1. Exposure depends on the attacker controlling the release distribution path, so systems installed from OS packages or pinned images that never self-update are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116189","severity":null,"published_at":"2026-10-25T14:16:59+00:00","modified_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}