PT-2026-89704

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

CVE-2026-88044: Incorrect Authorization

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

CVE-2026-88045: Memory Allocation with Excessive Size Value

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

PT-2026-89489

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When rclone serve s3 is configured with the --auth-proxy flag but without the --auth-key flag, the authPairMiddleware function registers any client-provided accessKeyID with an empty ws.s3Secret. The...

CVE-2026-87913: Unverified Ownership

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

PT-2026-89501

Name of the Vulnerable Software and Affected Versions rclone version 1.75.0 Description In streamed multipart mode, the serve s3 functionality allows a network client to cause memory exhaustion. The system passes the request's declared part length to the Reserve function in multipart.NewRW before...

PT-2026-89681

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...

PT-2026-89500

Name of the Vulnerable Software and Affected Versions rclone versions 1.70.0 through 1.75.0 Description The serve/start RC interface allows per-server configuration via a proxyOpt object. However, the FTP and S3 server constructors incorrectly validate the process-global proxy.Opt.AuthProxy value...

PT-2026-89470

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

SUSE CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...

OESA-2026-3689 aws-sdk-cpp security update

The AWS SDK for C++ provides a modern C++ version C++ 11 or later interface for Amazon Web Services AWS. This package contains the S3 component. Security Fixes: Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK...

OESA-2026-3688 aws-sdk-cpp security update

The AWS SDK for C++ provides a modern C++ version C++ 11 or later interface for Amazon Web Services AWS. This package contains the S3 component. Security Fixes: Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK...

OESA-2026-3687 aws-sdk-cpp security update

The AWS SDK for C++ provides a modern C++ version C++ 11 or later interface for Amazon Web Services AWS. This package contains the S3 component. Security Fixes: Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

SUSE CVE-2026-53470

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...

SUSE CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...