CVE-2026-116192: rclone server-side request forgery via --rc-serve scheme-relative roots

CVE-2026-116192 · Severity: medium · CVSS 5.9 · Published 2026-10-25

rclone is a command-line tool for synchronizing files with cloud storage and managing remote file systems. The vulnerability allows unauthenticated attackers to redirect HTTP and NetStorage requests to arbitrary hosts when the remote control server (--rc-serve) is enabled without authentication. An attacker can read responses from targeted servers, capture configured custom headers, or obtain valid NetStorage request signatures, potentially accessing sensitive information or data from internal systems.

Technologies: Rclone. Vendors: Rclone.

Quick answers

Is CVE-2026-116192 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116192 being exploited in the wild.
How severe is CVE-2026-116192?
Medium severity, with a CVSS score of 5.9, published 25 October 2026.
Which products and versions are affected?
Rclone 1.37 through 1.74.1.
Is there a fix for CVE-2026-116192?
Yes: fixed in 1.74.2. Until then: Ensure --rc-serve is disabled in production unless explicitly required, configure RC HTTP authentication, or restrict RC listener to trusted networks only (default bind is loopback). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116192 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116192?
Check whether you run Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.74.2

Ensure --rc-serve is disabled in production unless explicitly required, configure RC HTTP authentication, or restrict RC listener to trusted networks only (default bind is loopback).

Technical details

A server-side request forgery (SSRF) vulnerability in rclone's HTTP and NetStorage backends allows scheme-relative named-remote roots (beginning with //) to bypass the unauthenticated remote gate and replace the configured URL authority. When --rc-serve is enabled without RC authentication and an attacker knows an existing named remote's name, they can supply a crafted root like //attacker.example:9090/capture/ which is parsed as a network-path reference by Go's URL handler, causing HEAD/GET requests to be made to attacker-controlled endpoints with disclosure of custom headers and NetStorage signatures. The vulnerability requires non-default configuration (--rc-serve enabled, reachable, without RC authentication) but affects HTTP and NetStorage backends in versions 1.37 through 1.74.1.

Affected products

  • rclone rclone 1.37 through 1.74.1

Timeline

  • 2026-10-09: disclosed
  • 2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.