# rclone.

Every CVE that names rclone among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url](https://agentprime.io/advisories/CVE-2026-116196.md)
  `CVE-2026-116196` · CVE record: rclone rclone · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Weak cryptography or TLS
- [Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim](https://agentprime.io/advisories/CVE-2026-116195.md)
  `CVE-2026-116195` · CVE record: rclone rclone · CVSS 7.0 High · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback](https://agentprime.io/advisories/CVE-2026-116194.md)
  `CVE-2026-116194` · CVE record: rclone rclone · CVSS 7.6 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-346
- [Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests](https://agentprime.io/advisories/CVE-2026-116193.md)
  `CVE-2026-116193` · CVE record: rclone rclone · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots](https://agentprime.io/advisories/CVE-2026-116192.md)
  `CVE-2026-116192` · CVE record: rclone rclone · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Rclone before 1.75.2 Path Traversal via serve webdav MKCOL](https://agentprime.io/advisories/CVE-2026-116191.md)
  `CVE-2026-116191` · CVE record: rclone rclone · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Path traversal
- [rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect](https://agentprime.io/advisories/CVE-2026-116190.md)
  `CVE-2026-116190` · CVE record: rclone rclone · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Information disclosure
- [rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS](https://agentprime.io/advisories/CVE-2026-116189.md)
  `CVE-2026-116189` · CVE record: rclone rclone · CVSS 7.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Weak cryptography or TLS
- [rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow](https://agentprime.io/advisories/CVE-2026-116188.md)
  `CVE-2026-116188` · CVE record: rclone rclone · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Memory corruption
- [Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads](https://agentprime.io/advisories/CVE-2026-116187.md)
  `CVE-2026-116187` · CVE record: rclone rclone · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [rclone serve docker Path Traversal via Volume Name](https://agentprime.io/advisories/CVE-2026-93987.md)
  `CVE-2026-93987` · CVE record: rclone rclone · CVSS 4.6 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal
- [rclone before 1.75.1 Path Traversal via Directory Listing Names](https://agentprime.io/advisories/CVE-2026-93986.md)
  `CVE-2026-93986` · CVE record: rclone rclone · CVSS 2.3 Low · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal
- [rclone before 1.75.0 Authentication Bypass via pprof](https://agentprime.io/advisories/CVE-2026-79776.md)
  `CVE-2026-79776` · CVE record: rclone rclone · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure
- [rclone Archive Backend SquashFS Parser Denial of Service](https://agentprime.io/advisories/CVE-2026-79775.md)
  `CVE-2026-79775` · CVE record: rclone rclone · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-129

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=rclone>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/rclone/>. Everything for agents: <https://agentprime.io/llms.txt>.