CVE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116192?
CVE-2026-116192 is a high-severity vulnerability in rclone, published on 25 Oct 2026.
Official description
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
Weakness: CWE-918
Which versions are affected by CVE-2026-116192?
1 open source package ship an affected version, including rclone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rclone Bitnami | From 1.37.0 | 1.74.2 |
Products include Rclone Rclone.
How do I fix CVE-2026-116192?
Upgrade rclone to 1.74.2 or later.
Is CVE-2026-116192 being exploited?
There is no known exploitation of CVE-2026-116192 in the wild and no public exploit code.
Other vulnerabilities in rclone
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Sources
Also known as BIT-rclone-2026-116192, DEBIAN-CVE-2026-116192, GHSA-j48m-mpf8-5cpg, GHSA-xqmq-v4wj-rw5m, UBUNTU-CVE-2026-116192.