Bug 2560412 (CVE-2026-116189) - CVE-2026-116189 github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass
Summary: CVE-2026-116189 github.com/rclone/rclone: rclone: Arbitrary code execution vi...
Keywords:
Status: NEW
Alias: CVE-2026-116189
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2560525
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-25 13:33 UTC by OSIDB Bzimport
Modified: 2026-10-26 05:39 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-25 13:33:04 UTC 
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Note You need to log in before you can comment on or make changes to this bug.