CVE-2026-116189 PUBLISHED

rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

Assigner: VulnCheck
Reserved: 25.10.2026 Published: 25.10.2026 Updated: 25.10.2026

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	High	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	rclone
Product	rclone
Versions	Default: unaffected affected from 1.55.0 to 1.75.2 (excl.) Version 1.75.2 is unaffected

Credits

Kushalkhemka finder
ncw finder
mayank-jangid-moon finder
skigeek16 finder
opensec-intelligence finder

References

Problem Types

Improper Verification of Cryptographic Signature CWE