CVE-2026-71312 rclone CVE debrief

Who should care

Users of rclone versions prior to v1.75.0, especially those using SFTP and server-side hashing, should be aware of this vulnerability and take necessary actions to upgrade or mitigate the risk. This includes reviewing their configurations, restricting SFTP access, and implementing additional security measures. IT teams responsible for managing rclone deployments should prioritize this vulnerability and plan for remediation.

Technical summary

The rclone command-line program, prior to version v1.75.0, is vulnerable to a security issue where remote SFTP paths are interpolated into PowerShell hash commands without proper escaping of single-quote delimiters. This allows an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. The issue is fixed in v1.75.0.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows an attacker to execute PowerShell statements as the victim SSH account.

Recommended defensive actions

• Upgrade to rclone version v1.75.0 or later
• Restrict SFTP access to trusted users and validate user input
• Implement additional security measures, such as monitoring and logging
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in rclone versions prior to v1.75.0, where remote SFTP paths are interpolated into PowerShell hash commands without proper escaping of single-quote delimiters. This allows attacker-controlled filenames to execute PowerShell statements. Users should verify their rclone versions and configurations to identify potential exposure. Evidence is limited to public CVE and NVD details.

Official resources