{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rclone--1.75.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-116189"},{"cvss":7.5,"id":"CVE-2026-116191"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["rclone (1.55.0 - 1.75.1)","Rclone (\u003c 1.75.2)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","vulnerability","rclone","persistence","path-traversal","webdav"],"_cs_type":"advisory","_cs_vendors":["rclone"],"content_html":"\u003cp\u003eA signature verification bypass vulnerability (CVE-2026-116189) exists in the rclone 'selfupdate' mechanism. The update process fails to correctly validate the checksum block, specifically by trusting checksum lines that precede the PGP-clearsigned SHA256SUMS section. An attacker with the ability to influence the update distribution path can inject a malicious checksum, causing the rclone binary to download and execute an unauthorized, attacker-controlled file.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the user running the rclone process. This can lead to persistent access and potential lateral movement if rclone is utilized for sensitive data synchronization or system management tasks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade rclone to version 1.75.2 or later immediately to resolve the vulnerable verification logic in the selfupdate module.\u003c/li\u003e\n\u003cli\u003eReview environments where rclone 'selfupdate' is enabled; consider disabling the self-update mechanism in favor of centralized package management systems (e.g., APT, YUM, Brew) to reduce the attack surface.\u003c/li\u003e\n\u003cli\u003eAudit existing rclone installations for versions between 1.55.0 and 1.75.1.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T14:32:51Z","date_published":"2026-10-25T14:32:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rclone-update-bypass/","summary":"Rclone versions 1.55.0 through 1.75.1 contain a signature verification bypass in the selfupdate function that allows attackers to install malicious executables by prepending unsigned checksums to the verification block.","title":"Rclone: Self-update signature verification bypass (CVE-2026-116189)","url":"https://feed.craftedsignal.io/briefs/2026-10-rclone-update-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Rclone (\u003c 1.75.2)","version":"https://jsonfeed.org/version/1.1"}