CVE-2026-116192— rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Quick assessment

Affected

rclone rclone

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rclone 1.37 至 1.74.2 版本（不含 1.74.2）存在服务端请求伪造（SSRF）漏洞。未认证的攻击者可通过功能，在已命名的远程存储上提供双斜杠根路径（），从而重定向 HTTP 和 NetStorage 后端的请求。攻击者可向其指定的目标主机发起 HEAD 或 GET 请求，以读取响应内容、捕获已配置的自定义请求头，或获取有效的 NetStorage 请求签名。

CVSS 5.9 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Source: CVE Program / CVE List V5

Vulnerability Description

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rclone	rclone	1.37 ~ 1.74.2	-

II. Public POCs for CVE-2026-116192

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116192

请登录查看更多情报信息。

Other References for CVE-2026-116192 (2)

https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m vendor-advisory
https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116192

Same Patch Batch · rclone · 2026-10-25 · 10 CVEs total

CVE-2026-116189	7.5 HIGH	rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
CVE-2026-116191	7.5 HIGH	Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116194	6.8 MEDIUM	Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
CVE-2026-116195	6.1 MEDIUM	Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
CVE-2026-116188	5.3 MEDIUM	rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
CVE-2026-116196	5.3 MEDIUM	Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
CVE-2026-116193	5.3 MEDIUM	Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
CVE-2026-116187	5.0 MEDIUM	Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
CVE-2026-116190	3.7 LOW	rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

IV. Related Vulnerabilities

Same product: rclone

Same vendor: rclone

Same weakness: CWE-918