Server-Side Request Forgery Vulnerability in rclone

CVE-2026-116192

What is CVE-2026-116192?

rclone versions prior to 1.74.2 are vulnerable to a server-side request forgery (SSRF) that enables unauthenticated attackers to redirect HTTP requests to backend services. By exploiting this vulnerability using a specific input technique involving double-slash roots on existing named remotes with the --rc-serve option, attackers can execute unauthorized HEAD and GET requests. This allows them to glean information from compromised systems, such as custom headers and valid NetStorage request signatures, posing serious security risks. Users are advised to upgrade to rclone version 1.74.2 or later to mitigate this risk.

References