{"id":"CVE-2026-116192","title":"github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve (CVE-2026-116192)","summary":"A flaw was found in rclone. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery (SSRF). When the rc-serve feature is enabled, an attacker can provide a double-sla…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-918","vendor":"Red Hat","product":"Cryostat 4","affected":["cryostat 4","advanced_cluster_management_for_kubernetes 2"],"published":"2026-10-25","updated":"2026-10-26","sourceUpdated":"2026-10-26T07:07:22+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116192.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116192.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116192"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560406"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116192"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116192"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m"},{"url":"https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-25T22:08:29.943Z","epss":0.00223,"epssPercentile":0.12862,"slug":"CVE-2026-116192","body":"## Overview\n\nA flaw was found in rclone. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery (SSRF). When the rc-serve feature is enabled, an attacker can provide a double-slash path on an existing configured remote to redirect backend HTTP and NetStorage requests to an arbitrary destination. As a result, the attacker can intercept backend responses, capture sensitive custom headers, or obtain valid authentication signatures.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116192.json)\n\n**github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve** — rated Moderate by Red Hat. Released 2026-10-25, updated 2026-10-26.\n\nAffected:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}