Authorization Bypass in Rclone Affecting Multipart Uploads

CVE-2026-116187

What is CVE-2026-116187?

Rclone versions prior to v1.75.2 are susceptible to an authorization bypass vulnerability within the 'serve s3 --auth-proxy' functionality. This flaw allows authenticated tenants to improperly alter other tenants' multipart uploads by using the identifiers associated with those uploads. If an attacker discovers a victim's S3 bucket, object, and upload ID, they can manipulate ongoing uploads—injecting parts, completing, or even aborting them. Additionally, this vulnerability permits the unauthorized viewing of upload and object metadata belonging to other tenants, posing a significant risk to data integrity and confidentiality.

References