Skip to content
OpenAdvisories
High WID-SEC-2026-2623 6 CVEs

rclone: Mehrere Schwachstellen

Published Aug 2, 2026 · Updated Oct 25, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

Product

Rclone ist ein Open-Source-Befehlszeilenprogramm zur Synchronisierung von Dateien und Verzeichnissen mit verschiedenen Cloud-Speicherdiensten.

Vulnerabilities 6

  • Medium 6.5
    CVE-2026-79775

    rclone Archive Backend SquashFS Parser Denial of Service

    rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-control…

    rclone rclone rclone rclone Debian Ubuntu
  • Medium 5.3
    CVE-2026-79776

    rclone before 1.75.0 Authentication Bypass via pprof

    rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including …

    rclone rclone rclone rclone Debian Ubuntu
  • Medium 5.3
    CVE-2026-79778

    rclone before v1.75.0 Denial of Service via TUS nil-response panic

    rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads …

    rclone rclone rclone rclone Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-79779

    rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

    rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext ho…

    rclone rclone rclone rclone Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-79780

    rclone before v1.75.0 Credential Exposure via S3 Redirect

    rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture r…

    rclone rclone rclone rclone Debian Ubuntu Go
  • Low 2.7
    CVE-2026-79777

    rclone before v1.75.0 Information Disclosure via RC API

    rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

    rclone rclone rclone rclone Debian Ubuntu Go

Revision history

  1. #3

    Neue Updates von openSUSE aufgenommen

  2. #2

    Referenz(en) aufgenommen: CVE-2026-79779, EUVD-2026-65537, CVE-2026-79775, EUVD-2026-65533, CVE-2026-79776, EUVD-2026-65534, CVE-2026-79777, EUVD-2026-65535, CVE-2026-79778, EUVD-2026-65536, CVE-2026-79780, EUVD-2026-65538, GHSA-Q353-W8P3-4CJQ

  3. #1

    Initiale Fassung

References