Auth bypass in Rclone
CVE-2026-116187
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5 (vendor-advisory)
- www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-i… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-116187?
- CVE-2026-116187 is a medium-severity vulnerability in Rclone, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.0/10. Published 2026-10-25.
- How severe is CVE-2026-116187?
- Medium severity. CVSS v3 base score is 5.0 out of 10.