VULNERABILITY INTELLIGENCE

CVE-2026-116187

CVSS score5 MEDIUM
EPSS probability0.14%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-28
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

Weakness classification

  • disclosure@vulncheck.com: CWE-639

Primary references