passwordcheck

passwordcheck for rclone config files In https://github.com/rclone/rclone/issues/4783 a security issue was found which meant that passwords generated by "rclone config" might be insecure. This program checks your rclone config file for any of those passwords. Installation Download the relevant zi...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

RClone RC - Command Injection

Rclone = 1.48.0 and = 1.48.0 and 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment...

Rclone RC - Broken Access Control

Rclone = 1.45.0 and = 1.45.0 and 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint options/set allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires R...

CVE-2026-41179

CVE-2026-47668 Test environment for rclone RCE REF1: https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q REF2: https://github.com/pssec-io/CVE-2026-41179 rce.py RCE on /operations/fdinfo, redirects output to stderr for convenience ./rce.py uname -a exit status 1 Return code: ...

MGASA-2026-0586 Updated rclone package fixes security vulnerabilities

This update brings new features, bugs and vulnerabilities fixed in the rclone and golang components used to build it...

Updated rclone package fixes security vulnerabilities

This update brings new features, bugs and vulnerabilities fixed in the rclone and golang components used to build it...

Rclone REST Server Data Manipulation

The vulnerability in the REST server of the cloud synchronization tool Rclone relates to improper validation of the path name for restricted directories. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, and delete access to data...

Rclone Object Update Privilege Escalation

The vulnerability in the Object.Update function within the Rclone cloud synchronization backend is located in the local/local.go file. It stems from an incorrect reference definition prior to accessing a file. Exploitation of this vulnerability could enable a remote attacker to escalate their...

Rclone Cloud Sync

The vulnerability in the WithRemote function within the cmd/serve/restic/restic.go file of the Rclone cloud synchronization tool is related to improper validation of the path name for restricted directories. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, and...

Rclone cloud synchronization Remote Management Bypass

The remote management interface vulnerability in the Rclone cloud synchronization tool is related to system configuration errors or misconfigurations. Exploitation of this vulnerability enables a remote attacker to bypass existing security restrictions by sending specially crafted HTTP requests...

OPENSUSE-SU-2026:12505-1 rclone-1.76.0-1.1 on GA media

These are all security issues fixed in the rclone-1.76.0-1.1 package on the GA media of openSUSE Tumbleweed...

Rclone Cloud Sync Unauthenticated Access

The vulnerability in the ArchiveExtract function within the cmd/archive/extract/extract.go file of the Rclone cloud synchronization tool is related to improper validation of the path name for restricted directories. Exploitation of this vulnerability may allow an attacker to gain unauthorized...

GO-2026-6865 vulnerabilities

Vulnerabilities for packages: datadog-agent, slsa-verifier, tempo, datadog-operator, wal-g, azcopy, opencost, falcosidekick, gitsign, paranoia, conftest, terraform, dbmate, kafkaexporter, weaviate, ko, manifest-tool, pulumi-language-dotnet, witness, ipfs-cluster, grafana-pyroscope,...

CVE-2026-116591 vulnerabilities

Vulnerabilities for packages: datadog-agent, slsa-verifier, tempo, datadog-operator, wal-g, azcopy, opencost, falcosidekick, gitsign, paranoia, conftest, terraform, dbmate, kafkaexporter, weaviate, ko, manifest-tool, pulumi-language-dotnet, witness, ipfs-cluster, grafana-pyroscope,...

GHSA-FPMH-FRQ8-7RJ8 vulnerabilities

Vulnerabilities for packages: datadog-agent, slsa-verifier, tempo, datadog-operator, wal-g, azcopy, opencost, falcosidekick, gitsign, paranoia, conftest, terraform, dbmate, kafkaexporter, weaviate, ko, manifest-tool, pulumi-language-dotnet, witness, ipfs-cluster, grafana-pyroscope,...

CVE-2026-116193

A flaw was found in Rclone. This flaw allows an unauthenticated remote attacker to achieve information disclosure by bypassing authentication checks in the WebDAV Web Distributed Authoring and Versioning service. By sending HTTP OPTIONS requests to arbitrary paths and analyzing the returned Allow...

CVE-2026-116188

A flaw was found in rclone's S3 service. A remote attacker can trigger a Denial of Service DoS by sending concurrent multipart upload requests with excessively large lengths. This causes an integer overflow in the memory-accounting mechanism, bypassing configured buffer limits and retaining...

[SECURITY] Fedora 45 Update: rclone-1.75.2-1.fc45

"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Driv e, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files...

Fedora 45 : rclone (2026-7aab7a2bbe)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7aab7a2bbe advisory. Update to 1.75.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...