Live › vulnerability › CVE-2026-116192
Go to dashboardrclone versions from 1.37 before 1.74.2 let an unauthenticated attacker supply a double-slash root on an existing named remote through --rc-serve, redirecting HTTP and NetStorage backend requests to hosts the attacker chooses. The attacker can read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone's remote control server (--rc-serve) with at least one existing named remote that uses the http or netstorage backend. Exposure depends on whether the remote-control endpoint can be reached by untrusted clients, since the attacker needs no account. Hosts that use rclone only as a local CLI without the remote control server are not exposed by this flaw.
No product ranges from the sources yet.
rclone version and confirm whether the version is earlier than 1.74.2--rc-serve or rcd and reachable from untrusted networkshttp or netstorage remotes with custom headers1.74.2 or later--rc-serve on networks that untrusted clients can reachEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
This page as .md · .json · in your agent: get_signal("CVE-2026-116192")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.