5.0Orta
CVE-2026-116187Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
Açıklama
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
Zayıflık türü (CWE):
CWE-639
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-35g6-9fjv-rmx5) vendor-advisoryVendor Advisory
- VulnCheck Advisory: Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*≥ 1.68.0 < 1.75.2