CVE-2026-116192rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Beschreibung

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-xqmq-v4wj-rw5m) vendor-advisoryVendor Advisory
• VulnCheck Advisory: rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots third-party-advisoryThird Party Advisory