CVE-2026-116194 rclone CVE debrief

Who should care

Defenders responsible for Rclone installations, particularly those using versions between 1.52.0 and 1.75.2, should assess exposure and apply patches. They should also review vendor advisories, monitor for suspicious activity, and restrict access to Rclone's pCloud backend. Additionally, defenders should verify Rclone versions, check relevant monitoring and logs, and track exceptions and retest remediated assets to ensure the vulnerability is properly rem-

Why it matters

Defenders should care about CVE-2026-116194 because it affects Rclone versions between 1.52.0 and 1.75.2, potentially allowing CSRF attacks and unauthorized data transfers. Verification of versions, patching, and monitoring are crucial to prevent potential disruptions.

• Potential for unauthorized data transfers
• Need for verification of Rclone versions and patches
• Possible disruption of service due to CSRF attacks
• Requirement for monitoring and restricting access to Rclone's pCloud backend

Technical summary

The Rclone pCloud backend's localhost OAuth callback is vulnerable to CSRF attacks, allowing malicious web pages to plant attacker tokens and API hosts. This affects Rclone versions between 1.52.0 and 1.75.2. Defenders should prioritize verifying Rclone versions and applying patches to prevent potential CSRF attacks. The vulnerability can be exploited by sending stateless requests to port 53682 during authorization, potentially leading to unauthorized data transfers and service disruptions. Verification of versions, patching, and monitoring are crucial to prevent potential disruptions.

Defensive priority

Defenders should prioritize verifying Rclone versions and applying patches to prevent potential CSRF attacks.

Recommended defensive actions

• Verify Rclone version and apply patch to 1.75.2 or later
• Restrict access to Rclone's pCloud backend
• Monitor for suspicious requests to port 53682
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the CSRF vulnerability in Rclone. Further verification is needed to determine the full scope of affected versions and potential impact. Defenders should verify Rclone versions, review vendor advisories, and monitor for suspicious activity. The vulnerability affects Rclone versions between 1.52.0 and 1.75.2, and malicious web pages can send stateless requests to port 53682 during authorization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.