Rclone
CVE-2026-116189: rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clear
CVE-2026-116189 Oct 25, 2026 Source: Vendor
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-116189
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
5 lines
Showing 1–5 of 5
CVE-2026-116189
BR2026-0000-032230
unclaimed
Credited as Kushalkhemka
CVE-2026-116189
BR2026-0000-032231
unclaimed
Credited as ncw
CVE-2026-116189
BR2026-0000-032232
unclaimed
Credited as mayank-jangid-moon
CVE-2026-116189
BR2026-0000-032233
unclaimed
Credited as skigeek16
CVE-2026-116189
BR2026-0000-032234
unclaimed
Credited as opensec-intelligence