{"id":"CVE-2026-116189","title":"github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass (CVE-2026-116189)","summary":"A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signe…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-347","vendor":"Red Hat","product":"Cryostat 4","affected":["cryostat 4","advanced_cluster_management_for_kubernetes 2"],"published":"2026-10-25","updated":"2026-10-26","sourceUpdated":"2026-10-26T05:40:34+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116189.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116189.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116189"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560412"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116189"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116189"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8"},{"url":"https://www.vulncheck.com/advisories/rclone-1.55.0-before-1.75.2-selfupdate-signature-verification-bypass-via-sha256sums"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-25T22:08:29.942Z","epss":0.0015,"epssPercentile":0.04106,"slug":"CVE-2026-116189","body":"## Overview\n\nA flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signed checksum block, the attacker can cause the application to install a malicious binary, leading to arbitrary code execution.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116189.json)\n\n**github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass** — rated Important by Red Hat. Released 2026-10-25, updated 2026-10-26.\n\nAffected:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}