CVE-2026-88016 rclone CVE debrief

Who should care

Defenders responsible for cloud storage systems and rclone deployments should assess exposure and prioritize verification and remediation efforts. This includes operators managing rclone configurations, platform administrators overseeing cloud storage integrations, and security teams responsible for vulnerability management and incident response. These stakeholders must evaluate the potential impact on their systems, verify the presence of affected rclone

Why it matters

CVE-2026-88016 is a vulnerability in the rclone command-line program that allows an attacker to apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination when using the --links and --metadata flags. Defenders responsible for cloud storage systems and rclone deployments should assess exposure and prioritize verification and remediation efforts.

• An attacker could apply selected ownership to a file or directory outside the destination.
• An attacker could apply selected permissions to a file or directory outside the destination.
• An attacker could apply selected modification times to a file or directory outside the destination.
• An attacker could apply selected birth times to a file or directory outside the destination.

Technical summary

The rclone command-line program has a vulnerability that allows an attacker to apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination when using the --links and --metadata flags. This is due to the MkdirMetadata, writeMetadataToFile, and setTimes operating when Directory.translatedLink=false, allowing os.Chown, os.Chmod, os.Chtimes, and birth-time handling to bypass os.Root confinement and follow the symlink.

Defensive priority

Defenders should prioritize verifying and upgrading to rclone version 1.75.1 or later, and restrict usage of the --links and --metadata flags to trusted sources.

Recommended defensive actions

• Verify and upgrade to rclone version 1.75.1 or later
• Restrict usage of the --links and --metadata flags to trusted sources
• Monitor for suspicious activity related to rclone usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. The GitHub commits and release notes provide evidence of the fix. Specifically, commits 17b0c03338a857bcb0a68d2d4c82ddbdec3f7893 and a7ab39d3d1958afa1446982c1dc4e4a73a887e3e, along with the release notes for version 1.75.1, confirm the patch and provide details on the changes made to address the vulnerability. However, the exact scope of affected systems and the potential for exploitation remain limited by the need for an attacker to control the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.