MEDIUM 6.1 NVD
CVE-2026-116187
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
References
- https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5
- https://www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-s
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-10-25 via NVD.
vulnfeed aggregates 17091 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.