CVE-2026-116187Medium· 5.0▾ SunlitRclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who le…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
rclone >= 1.68.0 < 1.75.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116191High· 7.5Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116190Low· 3.7rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
CVE-2026-116194Medium· 6.8Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
CVE-2026-116189High· 7.5rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
CVE-2026-116195Medium· 6.1Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
CVE-2026-93986Low· 3.1rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names