CVE-2026-116187
Received Received - Intake

Authorization Bypass in Rclone S3 Auth Proxy

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116187
EUVD
EUVD-2026-109445

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone 1.68.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rclone versions 1.68.0 to 1.75.1 have an authorization bypass in the serve s3 --auth-proxy feature. Authenticated users can manipulate multipart uploads of other tenants by using their upload IDs. If an attacker knows a victim's bucket, object, and upload ID, they can inject parts, complete, or abort uploads and view metadata across tenants.

Detection Guidance

Check if your rclone version is between 1.68.0 and 1.75.2 by running: rclone version. If using serve s3 --auth-proxy, monitor for unusual multipart upload activity such as unexpected upload completions or aborts.

Impact Analysis

This vulnerability allows attackers to interfere with your ongoing uploads if they obtain your bucket, object, and upload ID. They could corrupt your uploads, cause data loss by aborting them, or view sensitive metadata about your uploads and objects. This affects integrity, availability, and confidentiality of your data during upload.

Compliance Impact

This vulnerability could lead to unauthorized access to data during upload, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. It may result in unauthorized data exposure or modification, posing compliance risks for organizations handling sensitive data.

Mitigation Strategies

Upgrade rclone to version 1.75.2 or later. Disable the serve s3 --auth-proxy feature if not required. Review and restrict access to multipart upload IDs and metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart