Rclone (< 1.75.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rclone--1.75.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 14:32:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRclone: Self-update signature verification bypass (CVE-2026-116189)https://feed.craftedsignal.io/briefs/2026-10-rclone-update-bypass/Sun, 25 Oct 2026 14:32:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rclone-update-bypass/Rclone versions 1.55.0 through 1.75.1 contain a signature verification bypass in the selfupdate function that allows attackers to install malicious executables by prepending unsigned checksums to the verification block.A signature verification bypass vulnerability (CVE-2026-116189) exists in the rclone 'selfupdate' mechanism. The update process fails to correctly validate the checksum block, specifically by trusting checksum lines that precede the PGP-clearsigned SHA256SUMS section. An attacker with the ability to influence the update distribution path can inject a malicious checksum, causing the rclone binary to download and execute an unauthorized, attacker-controlled file.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the user running the rclone process. This can lead to persistent access and potential lateral movement if rclone is utilized for sensitive data synchronization or system management tasks.

Recommendation

  • Upgrade rclone to version 1.75.2 or later immediately to resolve the vulnerable verification logic in the selfupdate module.
  • Review environments where rclone 'selfupdate' is enabled; consider disabling the self-update mechanism in favor of centralized package management systems (e.g., APT, YUM, Brew) to reduce the attack surface.
  • Audit existing rclone installations for versions between 1.55.0 and 1.75.1.
]]>highadvisorysupply-chainvulnerabilityrclonepersistencepath-traversalwebdav