BIT-rclone-2026-116189: rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2 - Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running rclone versions from 1.55.0 up to, but not including, 1.75.2 are affected when they use the stable selfupdate mechanism. Exploitation also requires an attacker to control the release distribution path used by selfupdate.
What does an attacker need to do to exploit the bypass?
The attacker must be able to alter the distributed SHA256SUMS content and provide a malicious rclone archive. They can prepend an unsigned checksum line for that archive before the PGP-clearsigned block, causing selfupdate to accept and install the attacker-controlled executable.
What should be done if updating is not immediately possible?
Avoid using the stable selfupdate mechanism until rclone can be updated to 1.75.2 or later. Treat the release distribution path and downloaded update artifacts as untrusted if their integrity cannot be assured.