ROOT-APP-GOBINARY-CVE-2026-88018 CVE-2026-88018 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-88018 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

GO-2026-6195 Authorization bypass in serve restic in github.com/rclone/rclone

Authorization bypass in serve restic in github.com/rclone/rclone...

PT-2026-80419

Path traversal via local backend encoding in github.com/rclone/rclone...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via improper sanitization of sensitive headers during HTTP redirects. An attacker can obtain confidential authorization tokens or encryption keys by intercepting network traffic when a redirect from...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the run function. An attacker can obtain sensitive internal information, such as file paths, Go module versions, goroutine states, memory addresses, and partial file contents by triggering a panic in the RC API a...