CVE-2026-116189 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116189?
CVE-2026-116189 is a high-severity vulnerability in rclone, published on 25 Oct 2026.
Official description
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Weakness: CWE-347
Which versions are affected by CVE-2026-116189?
1 open source package ship an affected version, including rclone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rclone Bitnami | From 1.55.0 | 1.75.2 |
Products include Rclone Rclone.
How do I fix CVE-2026-116189?
Upgrade rclone to 1.75.2 or later.
Is CVE-2026-116189 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116189 exists.
Other vulnerabilities in rclone
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Sources
Also known as BIT-rclone-2026-116189, DEBIAN-CVE-2026-116189, GHSA-mhj4-h9x6-3888, GHSA-w33h-3qgq-8mv8, UBUNTU-CVE-2026-116189.