CVE-2026-116187

Rclone versions v1.68.0 before v1.75.2 are vulnerable to an authorization bypass in the serve s3 --auth-proxy functionality. The root cause allows authenticated tenants to manipulate multipart uploads belonging to other tenants by referencing their specific upload IDs . If an attacker obtains a v...