restic

Introduction restic is a backup program that is fast, efficient and secure. It supports the three major operating systems Linux, macOS, Windows and a few smaller ones FreeBSD, OpenBSD. For detailed usage and installation instructions check out the documentation. You can ask questions in our...

CLEANSTART-2026-KE88989 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the restic-fips package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

SUSE CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

GO-2026-6184 Path traversal in serve restic in github.com/rclone/rclone

In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends such...

GO-2026-6195 Authorization bypass in serve restic in github.com/rclone/rclone

Authorization bypass in serve restic in github.com/rclone/rclone...

PT-2026-80417

In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends such...

PT-2026-80426

Authorization bypass in serve restic in github.com/rclone/rclone...

CVE-2026-55426: Improper Neutralization of Special Elements used in an OS Command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

BIT-RCLONE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: wireguard-go, hey, terraform-provider-sendgrid, gke-gcloud-auth-plugin, kubeflow, restic, k3d, kubeflow-katib, dynamic-localpv-provisioner, go, grpcurl...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: kargo, minio, k8sgpt-operator, tflint, sops, melange, spire-server, falcosidekick, zarf, step, terraform-docs, trivy, zot, dex, dbmate, k8sgpt, conftest, terraform-provider-google, fulcio, certificate-transparency, opentelemetry-collector-contrib, cert-manager-cmctl,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: argo-workflows, fluent-bit-plugin-loki, secrets-store-csi-driver-provider-azure, tkn, sops, policy-controller, airflow, flux-image-reflector-controller, spire-server, pulumi, zarf, step, trivy, zot, sqlpad, boring-registry, argo-events, bank-vaults, chezmoi, k8sgpt,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, aactl, timoni, openbao-k8s, spire-controller-manager, policy-controller, terraform-provider-time, grafana-operator, nri-f5, local-path-provisioner, dkron, dockerize, terraform-docs, opensearch-k8s-operator,...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-68970 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-68970 Source advisory:...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-59242 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-59242 Source advisory:...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-68970 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-68970 Source advisory:...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-68968 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-68968 Source advisory:...

CVE-2026-71309

A flaw was found in rclone. The rclone serve restic component, which handles cloud storage operations, contains an incomplete path validation vulnerability. An attacker with access to the REST endpoint can exploit this by using specially crafted URL paths containing directory traversal sequences...

Linux Distros Unpatched Vulnerability : CVE-2026-71309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does...

CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...