passwordcheck

passwordcheck for rclone config files In https://github.com/rclone/rclone/issues/4783 a security issue was found which meant that passwords generated by "rclone config" might be insecure. This program checks your rclone config file for any of those passwords. Installation Download the relevant zi...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

CVE-2026-116190

A flaw was found in rclone. When interacting with WebDAV storage services, rclone inadvertently forwards user-configured custom credential headers to external destinations across HTTP redirects. A remote attacker who controls or influences a target redirect server could intercept sensitive...

CVE-2026-116196

A flaw was found in Rclone. This vulnerability allows information disclosure due to improper handling of HTTP redirects within the Backblaze B2 storage backend. When download requests are redirected, the client inadvertently forwards sensitive account authorization tokens and Server-Side Encrypti...

CVE-2026-116195

A flaw was found in rclone. A path traversal vulnerability exists in the local storage backend where link suffixes are trimmed after directory containment checks are performed. By placing a specially crafted directory into a source tree synchronized with link and metadata flags enabled, an attack...

CVE-2026-116194

A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery CSRF vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state an...

CVE-2026-116192

A flaw was found in rclone. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery SSRF. When the rc-serve feature is enabled, an attacker can provide a double-slash path on an existing configured remote to redirect backend...

CVE-2026-116187

A flaw was found in Rclone's S3 authentication proxy. This authorization bypass allows an authenticated tenant who obtains another user's upload identifiers to interact with in-progress multipart uploads across tenant boundaries. A remote authenticated attacker can exploit this flaw to inject...

CVE-2026-116191

A flaw was found in Rclone's Web Distributed Authoring and Versioning WebDAV service. Due to improper validation of directory traversal sequences, a remote, unauthenticated attacker can send specially crafted WebDAV requests containing directory traversal sequences. This vulnerability allows the...

CVE-2026-116189

A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signed checksum block, the attacker can cause the application t...

Rclone RC - Broken Access Control

Rclone = 1.45.0 and = 1.45.0 and 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint options/set allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires R...

RClone RC - Command Injection

Rclone = 1.48.0 and = 1.48.0 and 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment...

Security update for rclone (important)

openSUSE Security Update: Security update for rclone Announcement ID: openSUSE-SU-2026:0354-1 Rating: important References: 1279548 Cross-References: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-46603 CVE-2026-56853 CVE-2026-56854 CVE-2026-56855 CVE-2026-56858 CVE-2026-56859 CVE-2026-568...

CVE-2026-41179

CVE-2026-47668 Test environment for rclone RCE REF1: https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q REF2: https://github.com/pssec-io/CVE-2026-41179 rce.py RCE on /operations/fdinfo, redirects output to stderr for convenience ./rce.py uname -a exit status 1 Return code: ...

DEBIAN-CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

DEBIAN-CVE-2026-116191

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...

DEBIAN-CVE-2026-116194

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting...

DEBIAN-CVE-2026-116192

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...

DEBIAN-CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...