Vendor
SigV4 Authentication Bypass in rclone serve s3
4 TTPs 1 CVEA critical authentication bypass vulnerability in rclone's S3 serving mode allows unauthenticated attackers to spoof identity via forged SigV4 signatures when '--auth-proxy' is used without '--auth-key'.
Authorization Bypass in rclone serve restic --private-repos
1 rule 5 TTPs 3 CVEsAn authorization bypass vulnerability in rclone's restic server allows authenticated users to access and manipulate repositories of other users via path traversal, impacting multi-tenant environments using backend storage that canonicalizes path segments.
Rclone Unauthenticated Remote Code Execution Vulnerabilities
2 rules 2 TTPs 2 CVEsRclone versions prior to 1.73.5 are vulnerable to two critical unauthenticated remote code execution vulnerabilities (CVE-2026-41176 and CVE-2026-41179) when the remote control API is enabled without authentication, potentially allowing attackers to execute arbitrary commands and compromise the system.
Rclone Unauthenticated options/set Allows Runtime Auth Bypass
2 rules 3 TTPsRclone is vulnerable to an unauthenticated options/set vulnerability that allows runtime authentication bypass, potentially leading to sensitive operations and command execution by setting `rc.NoAuth=true` on reachable RC servers started without global HTTP authentication.
Potential Data Exfiltration via Rclone
3 rules 1 TTPThe rule detects the abuse of rclone, a legitimate file synchronization tool, potentially renamed to evade detection, to exfiltrate data to cloud storage or remote endpoints, using copy/sync commands and specific file filters.