Rclone: Self-update signature verification bypass (CVE-2026-116189)

A signature verification bypass vulnerability (CVE-2026-116189) exists in the rclone 'selfupdate' mechanism. The update process fails to correctly validate the checksum block, specifically by trusting checksum lines that precede the PGP-clearsigned SHA256SUMS section. An attacker with the ability to influence the update distribution path can inject a malicious checksum, causing the rclone binary to download and execute an unauthorized, attacker-controlled file.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the user running the rclone process. This can lead to persistent access and potential lateral movement if rclone is utilized for sensitive data synchronization or system management tasks.

Recommendation

• Upgrade rclone to version 1.75.2 or later immediately to resolve the vulnerable verification logic in the selfupdate module.
• Review environments where rclone 'selfupdate' is enabled; consider disabling the self-update mechanism in favor of centralized package management systems (e.g., APT, YUM, Brew) to reduce the attack surface.
• Audit existing rclone installations for versions between 1.55.0 and 1.75.1.