Vulnerability Description
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rclone | Rclone | >= 1.37, < 1.74.2 |
Related Weaknesses (CWE)
References
- https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5mVendor Advisory
- https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-Third Party Advisory
FAQ
What is CVE-2026-116192?
CVE-2026-116192 is a vulnerability with a CVSS score of 5.9 (MEDIUM). rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash r...
How severe is CVE-2026-116192?
CVE-2026-116192 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116192?
Check the references section above for vendor advisories and patch information. Affected products include: Rclone Rclone.