CVE-2026-116192GHSA-xqmq-v4wj-rw5m
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
rclone rclone
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.74.2rcloneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
Text from CVE List
Affected versions 2
- rcloneaffected: 1.37 before 1.74.2CVE List
- rcloneunaffected: 1.74.2CVE List