CVE-2026-116187

Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Published Oct 25, 2026 CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

Analysis

Technical impact

The Rclone vulnerability allows an authenticated tenant to manipulate other tenants’ multipart uploads by referencing upload IDs. An attacker who learns a victim’s bucket, object, and upload ID can inject parts, complete, abort in‑flight uploads, or view upload and object metadata across tenants, effectively enabling cross‑tenant data tampering.

Affected Systems

Rclone versions 1.68.0 through 1.75.1 are affected. The flaw exists in the serve s3 –auth-proxy component of these releases and is fixed in v1.75.2 and newer.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated to the S3 serve and must obtain the victim’s bucket, object, and upload ID. Based on the description, the likely attack vector involves crafting S3 API calls to the authenticated proxy endpoint to manipulate multipart uploads.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rclone

unaffected

Version	Status	Constraints
`1.68.0`	affected	< 1.75.2
`1.75.2`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Rclone

Version	Status	Scheme	Platform
`[1.68.0,1.75.2)`	affected	semver	—
`1.75.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update rclone to v1.75.2 or later, which contains the fix for the authorization bypass.
If upgrading immediately is not possible, restrict access to the serve s3 –auth-proxy endpoint to administrators only or disable it for non‑admin tenants until the patch can be applied.
Audit S3 logs for anomalous multipart upload activities and enforce strict tenant isolation policies to mitigate unauthorized modifications.

Generated by OpenCVE AI on October 25, 2026 at 17:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.143% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5
https://nvd.nist.gov/vuln/detail/CVE-2026-116187
https://www.cve.org/CVERecord?id=CVE-2026-116187
https://www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-serve-s3-multipart-uploads

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116187 https://www.cve.org/CVERecord?id=CVE-2026-116187
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
Title		Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
First Time appeared		Rclone Rclone rclone
Weaknesses		CWE-639
CPEs		cpe:2.3:a:rclone:rclone::::::::
Vendors & Products		Rclone Rclone rclone
References		https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5 https://www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-serve-s3-multipart-uploads
Metrics		cvssV3_1 `{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 6.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}`