Signature Verification Bypass in rclone Affects Selfupdate Process
CVE-2026-116189

7.7HIGH

Key Information:

Vendor

Rclone

Status
Rclone
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116189?

A vulnerability exists in rclone versions prior to 1.75.2, where the selfupdate feature can be exploited due to improper handling of unsigned checksums. Attackers on the distribution path can inject malicious checksum lines, enabling the installation of unauthorized rclone executables instead of legitimate updates. This jeopardizes the integrity of the software and poses serious security risks to users.

Affected Version(s)

rclone 1.55.0 < 1.75.2

rclone 1.75.2

References

https://github.com/rclone/rclone/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/rclone-1.55.0-before...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
ncw
mayank-jangid-moon
skigeek16
opensec-intelligence
.