{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arclonerclone/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54572"},{"id":"CVE-2026-71309"},{"cvss":8,"id":"CVE-2026-71312"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["rclone (1.74.3)","rclone"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["rclone"],"content_html":"\u003cp\u003eThe rclone \u003ccode\u003eserve restic\u003c/code\u003e command includes a \u003ccode\u003e--private-repos\u003c/code\u003e feature intended to provide multi-tenant isolation by restricting users to their own path prefix (e.g., \u003ccode\u003e/\u0026lt;username\u0026gt;/\u003c/code\u003e). This security boundary is enforced by two separate chi middlewares that handle request authorization and object path resolution differently. The \u003ccode\u003echeckPrivate\u003c/code\u003e middleware validates that the authenticated user matches the initial path segment. However, the \u003ccode\u003eWithRemote\u003c/code\u003e middleware constructs the backend object key using the raw, un-cleaned URL path.\u003c/p\u003e\n\u003cp\u003eAn authenticated user can bypass this confinement by sending a request with a traversal sequence, such as \u003ccode\u003eGET /\u0026lt;attacker\u0026gt;/../\u0026lt;victim\u0026gt;/config\u003c/code\u003e. Because the path starts with the attacker's username, the authorization middleware permits the request. However, backends that use POSIX \u003ccode\u003epath.Clean\u003c/code\u003e semantics (including the common \u003ccode\u003esftp\u003c/code\u003e, \u003ccode\u003eftp\u003c/code\u003e, and \u003ccode\u003ememory\u003c/code\u003e backends) resolve the \u003ccode\u003e..\u003c/code\u003e segment, directing the operation to the victim's repository. This vulnerability enables unauthorized reading, overwriting, or deletion of another tenant's backup metadata and blobs. The vulnerability affects rclone version 1.74.3.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a valid, low-privileged authenticated session on the target rclone instance configured with \u003ccode\u003e--private-repos\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request using path traversal sequences, targeting a victim's repository path (e.g., \u003ccode\u003e/mallory/../alice/config\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003echeckPrivate\u003c/code\u003e middleware observes the initial path segment (\u003ccode\u003emallory\u003c/code\u003e) and confirms it matches the authenticated session user, allowing the request to proceed.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eWithRemote\u003c/code\u003e middleware captures the un-cleaned URL path \u003ccode\u003emallory/../alice/config\u003c/code\u003e and passes it as the remote key to the storage backend.\u003c/li\u003e\n\u003cli\u003eThe storage backend (e.g., SFTP/FTP) invokes POSIX path normalization, collapsing \u003ccode\u003emallory/../alice/config\u003c/code\u003e into \u003ccode\u003ealice/config\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe backend handler executes the requested operation (GET, POST, or DELETE) against the victim's resource.\u003c/li\u003e\n\u003cli\u003eAttacker successfully exfiltrates metadata/blobs, poisons the repository, or deletes the victim's backups.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a total loss of confidentiality, integrity, and availability for the victim's restic repository on the affected server. Attackers can read sensitive restic \u003ccode\u003econfig\u003c/code\u003e and \u003ccode\u003ekeys\u003c/code\u003e metadata, poison existing backups by overwriting objects, or delete the entire repository. This vulnerability effectively nullifies the multi-tenant isolation provided by the \u003ccode\u003e--private-repos\u003c/code\u003e flag. The impact is critical for hosting providers or organizations sharing a single rclone restic server among multiple users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the following actions to secure rclone instances:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade rclone to the latest patched version addressing this bypass, or disable the \u003ccode\u003e--private-repos\u003c/code\u003e flag until an update is applied.\u003c/li\u003e\n\u003cli\u003eAudit existing multi-tenant rclone deployments to identify those utilizing the \u003ccode\u003e--private-repos\u003c/code\u003e flag with backends like SFTP or FTP.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls or proxy-based URL path normalization to reject requests containing \u003ccode\u003e..\u003c/code\u003e or \u003ccode\u003e%2e%2e\u003c/code\u003e sequences before they reach the rclone server.\u003c/li\u003e\n\u003cli\u003eUse backends that do not rely on implicit POSIX path normalization if available, or isolate multi-tenant backup repositories at the infrastructure level rather than relying on application-layer flags.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T15:22:14Z","date_published":"2026-08-05T21:25:39Z","id":"https://feed.craftedsignal.io/briefs/2026-08-rclone-auth-bypass/","summary":"An authorization bypass vulnerability in rclone's restic server allows authenticated users to access and manipulate repositories of other users via path traversal, impacting multi-tenant environments using backend storage that canonicalizes path segments.","title":"Authorization Bypass in rclone serve restic --private-repos","url":"https://feed.craftedsignal.io/briefs/2026-08-rclone-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}