CVE-2026-116192 rclone CVE debrief

Who should care

Defenders responsible for rclone instances, especially those with --rc-serve enabled, should assess exposure and potential for unauthorized requests. This includes operators managing rclone deployments, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and assessing potential impacts on their systems.

Why it matters

Defenders should prioritize verifying exposure of rclone instances and assess potential for unauthorized requests due to the server-side request forgery vulnerability.

• Potential for attackers to make unauthorized requests to internal or external resources
• Possible exposure of sensitive information through response capture
• Risk of obtaining valid NetStorage request signatures for unauthorized access

Technical summary

The vulnerability exists in rclone versions 1.37 before 1.74.2 and allows unauthenticated attackers to redirect HTTP and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. This can lead to unauthorized requests to internal or external resources, potentially exposing sensitive information or allowing attackers to obtain valid NetStorage request signatures for unauthorized access. Defenders should prioritize verifying exposure of rclone instances, especially those with --rc-serve enabled, and assess the potential for attackers to make unauthorized requests.

Defensive priority

Defenders should prioritize verifying exposure of rclone instances, especially those with --rc-serve enabled, and assess the potential for attackers to make unauthorized requests.

Recommended defensive actions

• Verify rclone instances for exposure, especially those with --rc-serve enabled
• Assess potential for attackers to make unauthorized requests
• Update to version 1.74.2 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported in rclone versions 1.37 before 1.74.2. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected systems is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.