Product by Open Source
Rclone
26 known vulnerabilities in Rclone (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-49980 | Rclone: Missing Authentication for Critical Function | 9.8 | |
| High | CVE-2026-116191 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL | 7.5 | |
| High | CVE-2026-59733 | Rclone: Path Traversal | 8.8 | |
| High | CVE-2026-71309 | rclone: Incomplete path validation allows backend root escape in serve restic | — | |
| High | CVE-2026-71312 | rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution | 8.0 | |
| High | CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots | 5.9 | |
| Medium | CVE-2026-71310 | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory | 5.9 | |
| High | CVE-2026-116189 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS | 7.5 | |
| High | CVE-2026-116194 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback | 6.8 | |
| High | CVE-2026-54572 | Rclone: Link Following | 7.5 | |
| High | CVE-2026-79775 | rclone Archive Backend SquashFS Parser Denial of Service | 6.5 | |
| Medium | CVE-2026-116188 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow | 5.3 | |
| Medium | CVE-2026-79776 | rclone before 1.75.0 Authentication Bypass via pprof | 5.3 | |
| Medium | CVE-2026-116193 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests | 5.3 | |
| High | CVE-2026-116195 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim | 6.1 | |
| Medium | CVE-2026-71311 | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines | 6.4 | |
| Medium | CVE-2026-116190 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect | 3.7 | |
| Medium | CVE-2026-71313 | rclone: Local Encoding Path Traversal | 6.9 | |
| Medium | CVE-2026-116187 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads | 5.0 | |
| Medium | CVE-2026-116196 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url | 5.3 | |
| Medium | CVE-2024-52522 | Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata | — | |
| Medium | CVE-2026-79778 | rclone before v1.75.0 Denial of Service via TUS nil-response panic | 5.3 | |
| Medium | CVE-2026-79780 | rclone before v1.75.0 Credential Exposure via S3 Redirect | 5.3 | |
| Medium | CVE-2026-79779 | rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect | 5.3 | |
| Medium | CVE-2026-79777 | rclone before v1.75.0 Information Disclosure via RC API | 2.7 |