CVE-2026-116192rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Description

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-xqmq-v4wj-rw5m) vendor-advisoryVendor Advisory
• VulnCheck Advisory: rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots third-party-advisoryThird Party Advisory