PT-2026-99021

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...

SUSE CVE-2026-72920

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

SUSE CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88018

A flaw was found in rclone. When the rclone serve s3 command is configured with --auth-proxy but without --auth-key, an unauthenticated network attacker can bypass the SigV4 signature verification process. This allows the attacker to use an arbitrary access key and sign requests with an empty...

CVE-2026-94368 Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368: Improper Verification of Cryptographic Signature

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

BIT-RCLONE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

BIT-RCLONE-2026-88044 rclone: RC per-server auth-proxy bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

PT-2026-95842

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

PT-2026-95841

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

Rclone 1.70.x < 1.75.1 RC Per-Server Auth-Proxy Bypass (CVE-2026-88044)

The version of Rclone installed on the remote host is 1.70.x prior to 1.75.1. It is, therefore, affected by an authentication bypass vulnerability: - The serve/start remote control method accepts protocol options in a per-server proxyOpt object, but the FTP and S3 server constructors decide wheth...

GO-2026-6456 rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone

rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone...

GO-2026-6462 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone...

BIT-RCLONE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-44162

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-44162

fluent-plugin-s3 (versions 0.7.0 to 1.8.4) is vulnerable to a decompression bomb in its in_s3 input plugin (CWE-409). The plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload o...

EUVD-2026-77705

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-44162 fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-44162 fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...