CVE-2026-116189High· 7.5▾ TwilightA flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signe…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.1%
A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signed checksum block, the attacker can cause the application to install a malicious binary, leading to arbitrary code execution.
github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass — rated Important by Red Hat. Released 2026-10-25, updated 2026-10-26.
Affected:
No fix planned:
Affected
Workarounds / mitigations:
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
CVE-2026-116192Medium· 5.9github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve (CVE-2026-116192)
CVE-2026-116196Medium· 5.3github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend (CVE-2026-116196)
CVE-2026-116194Medium· 6.8github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)
CVE-2026-115374High· 7.1github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs (CVE-2026-115374)
CVE-2026-10579Critical· 9.8A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role