# Rclone vulnerabilities Source: https://junglewise.ai/threats/technologies/rclone Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rclone.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in Rclone: 0 in the last 7 days and 26 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116196, was published on 25 October 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 26 - All time: 37 (5 critical, 0 exploited in the wild) ## About Rclone A command-line program to sync files and directories to and from cloud storage providers. ## Latest Rclone vulnerabilities - [CVE-2026-116196: Rclone B2 backend credential exposure on HTTP redirects](https://junglewise.ai/threats/cve-2026-116196-rclone-before-v1-75-2-contains-a-credential-exposure) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116195: Rclone path traversal in translateLink function](https://junglewise.ai/threats/cve-2026-116195-rclone-before-1-75-2-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.1, published 25 Oct 2026) - [CVE-2026-116194: Rclone cross-site request forgery in pCloud OAuth callback](https://junglewise.ai/threats/cve-2026-116194-rclone-from-1-52-0-before-1-75-2-contains-a-cross-site-request) (medium, CVSS 6.8, published 25 Oct 2026) - [CVE-2026-116193: Rclone serve webdav authentication bypass via OPTIONS requests](https://junglewise.ai/threats/cve-2026-116193-rclone-from-1-64-0-before-1-75-2-contains-an-authentication) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116192: rclone server-side request forgery via --rc-serve scheme-relative roots](https://junglewise.ai/threats/cve-2026-116192-rclone-from-1-37-before-1-74-2-contains-a-server-side-request) (medium, CVSS 5.9, published 25 Oct 2026) - [CVE-2026-116189: rclone selfupdate signature verification bypass in SHA256SUMS](https://junglewise.ai/threats/cve-2026-116189-rclone-from-1-55-0-before-1-75-2-contains-a-signature) (high, CVSS 7.5, published 25 Oct 2026) - [CVE-2026-116188: rclone serve s3 integer overflow in multipart accounting](https://junglewise.ai/threats/cve-2026-116188-rclone-serve-s3-versions-1-75-0-before-1-75-2-contain-an-integer) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116187: Rclone authorization bypass in serve s3 multipart uploads](https://junglewise.ai/threats/cve-2026-116187-rclone-from-v1-68-0-before-v1-75-2-contains-an-authorization) (medium, CVSS 5, published 25 Oct 2026) - [CVE-2026-88046: rclone path traversal via object name escaping on upload](https://junglewise.ai/threats/cve-2026-88046-rclone-path-traversal-via-object-name-escaping-on-upload) (medium, CVSS 5.3, published 10 Sep 2026) - [CVE-2026-88045: rclone serve S3 multipart declared-length memory exhaustion](https://junglewise.ai/threats/cve-2026-88045-rclone-serve-s3-multipart-declared-length-memory-exhaustion) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-88044: rclone per-server auth-proxy bypass in FTP and S3](https://junglewise.ai/threats/cve-2026-88044-rclone-per-server-auth-proxy-bypass-in-ftp-and-s3) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-88018: rclone serve s3 SigV4 signature bypass with --auth-proxy](https://junglewise.ai/threats/cve-2026-88018-rclone-serve-s3-sigv4-signature-bypass-with-auth-proxy) (critical, CVSS 9.8, published 10 Sep 2026) - [CVE-2026-88017: rclone FTP cross-session auth-proxy backend confusion](https://junglewise.ai/threats/cve-2026-88017-rclone-ftp-cross-session-auth-proxy-backend-confusion) (high, CVSS 7.3, published 10 Sep 2026) - [CVE-2026-88016: rclone directory metadata escape through symlink in --links mode](https://junglewise.ai/threats/cve-2026-88016-rclone-directory-metadata-escape-through-symlink-in-links-mode) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2026-88015: rclone local symlink Range header DoS](https://junglewise.ai/threats/cve-2026-88015-rclone-local-symlink-range-header-dos) (medium, CVSS 5.3, published 10 Sep 2026) - [CVE-2026-88014: rclone archive/zip Zip Slip path traversal](https://junglewise.ai/threats/cve-2026-88014-rclone-archive-zip-zip-slip-path-traversal) (medium, CVSS 6.3, published 10 Sep 2026) - [CVE-2026-88013: rclone http backend header forwarding on redirect](https://junglewise.ai/threats/cve-2026-88013-rclone-http-backend-header-forwarding-on-redirect) (low, CVSS 3.7, published 10 Sep 2026) - [CVE-2026-79783: rclone local backend privilege escalation via setuid metadata](https://junglewise.ai/threats/cve-2026-79783-rclone-local-backend-privilege-escalation-via-setuid-metadata) (low, CVSS 3.6, published 25 Aug 2026) - [CVE-2026-79782: rclone S3 security token disclosure on HTTPS-to-HTTP redirect](https://junglewise.ai/threats/cve-2026-79782-rclone-s3-security-token-disclosure-on-https-to-http-redirect) (low, CVSS 3.1, published 25 Aug 2026) - [CVE-2026-79781: rclone serve s3 path traversal via dot-dot object keys](https://junglewise.ai/threats/cve-2026-79781-rclone-serve-s3-path-traversal-via-dot-dot-object-keys) (medium, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-79780: rclone S3 redirect credential exposure in IBM IAM and SSE-C](https://junglewise.ai/threats/cve-2026-79780-rclone-s3-redirect-credential-exposure-in-ibm-iam-and-sse-c) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-79779: rclone WebDAV credential exposure via HTTPS-to-HTTP redirect](https://junglewise.ai/threats/cve-2026-79779-rclone-webdav-credential-exposure-via-https-to-http-redirect) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-79778: rclone WebDAV TUS nil-response denial of service](https://junglewise.ai/threats/cve-2026-79778-rclone-webdav-tus-nil-response-denial-of-service) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-79777: rclone RC API information disclosure via stack traces](https://junglewise.ai/threats/cve-2026-79777-rclone-rc-api-information-disclosure-via-stack-traces) (low, CVSS 3.1, published 25 Aug 2026) - [CVE-2026-79776: rclone pprof authentication bypass in RC server](https://junglewise.ai/threats/cve-2026-79776-rclone-pprof-authentication-bypass-in-rc-server) (medium, CVSS 5.3, published 25 Aug 2026) ## Most severe Rclone vulnerabilities - [CVE-2026-41179: Rclone unauthenticated remote code execution in RC operations/fsinfo](https://junglewise.ai/threats/cve-2026-41179-rclone-unauthenticated-remote-code-execution-in-rc-operations) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-41176: Rclone authentication bypass in Remote Control options/set endpoint](https://junglewise.ai/threats/cve-2026-41176-rclone-authentication-bypass-in-remote-control-options-set) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-49980: Rclone unauthenticated command execution in rcd via inline remotes](https://junglewise.ai/threats/cve-2026-49980-rclone-unauthenticated-command-execution-in-rcd-via-inline) (critical, CVSS 9.8, published 24 Jun 2026) - [CVE-2026-88018: rclone serve s3 SigV4 signature bypass with --auth-proxy](https://junglewise.ai/threats/cve-2026-88018-rclone-serve-s3-sigv4-signature-bypass-with-auth-proxy) (critical, CVSS 9.8, published 10 Sep 2026) - [CVE-2026-88044: rclone per-server auth-proxy bypass in FTP and S3](https://junglewise.ai/threats/cve-2026-88044-rclone-per-server-auth-proxy-bypass-in-ftp-and-s3) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-59733: Rclone path traversal in serve restic private-repos](https://junglewise.ai/threats/cve-2026-59733-rclone-path-traversal-in-serve-restic-private-repos) (high, CVSS 8.8, published 14 Jul 2026) - [CVE-2026-71312: rclone command injection via PowerShell smart-quotes in SFTP backend](https://junglewise.ai/threats/cve-2026-71312-rclone-command-injection-via-powershell-smart-quotes-in-sftp) (high, CVSS 8, published 5 Aug 2026) - [CVE-2026-88045: rclone serve S3 multipart declared-length memory exhaustion](https://junglewise.ai/threats/cve-2026-88045-rclone-serve-s3-multipart-declared-length-memory-exhaustion) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-54572: Rclone improper link resolution in local destination sync](https://junglewise.ai/threats/cve-2026-54572-rclone-improper-link-resolution-in-local-destination-sync) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-116189: rclone selfupdate signature verification bypass in SHA256SUMS](https://junglewise.ai/threats/cve-2026-116189-rclone-from-1-55-0-before-1-75-2-contains-a-signature) (high, CVSS 7.5, published 25 Oct 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 9 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 9 | 2 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 8 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Rclone vulnerabilities", https://junglewise.ai/threats/technologies/rclone, 9 November 2026.