CVE-2026-88046 rclone CVE debrief

Who should care

Cloud storage administrators and users who utilize rclone for syncing files and directories should assess their exposure and verify their inventory of rclone deployments. This vulnerability could allow an attacker to access unauthorized resources, potentially leading to data breaches or other security incidents.

Why it matters

CVE-2026-88046 is a medium-severity vulnerability in rclone that could allow an attacker to escape the configured root directory and access other buckets, shares, or paths reachable by the victim's credential. The issue is fixed in version 1.75.1, but the scope of affected versions and deployments requires verification.

• Potential unauthorized access to cloud storage resources
• Possible data breaches or security incidents
• Need to verify inventory of rclone deployments and update to version 1.75.1 or later
• Requirement to monitor for suspicious activity and review logs

Technical summary

The rclone command-line program has a vulnerability that allows an attacker to escape the configured root directory and access other buckets, shares, or paths reachable by the victim's credential. This issue is due to the program not rejecting parent-directory segments in source Object.Remote() values before passing them to destination backends. The vulnerability is fixed in version 1.75.1. A flat-keyspace source object store populated with native non-rclone tooling can contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot can neutralize the segment. A

Defensive priority

Medium

Recommended defensive actions

• Review and update rclone to version 1.75.1 or later
• Assess exposure and verify inventory of rclone deployments
• Monitor for suspicious activity and review logs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the scope of affected versions and deployments requires verification. The issue is fixed in version 1.75.1, but additional information about the vulnerability and its impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.