CVE-2026-116189

HIGH 7.5

rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

CWE	CWE-347
Vendor	rclone
Product	rclone
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new high vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

rclone / rclone

1.55.0 < 1.75.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8 vulncheck.com: https://www.vulncheck.com/advisories/rclone-1.55.0-before-1.75.2-selfupdate-signature-verification-bypass-via-sha256sums

Credits

Kushalkhemka ncw mayank-jangid-moon skigeek16 opensec-intelligence