CVE-2026-116187: Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Q: Which deployments are exposed to this issue?

Rclone versions from v1.68.0 through versions before v1.75.2 are affected when using serve s3 with the --auth-proxy option. The issue concerns multipart-upload operations in multi-tenant environments.

Q: What does an attacker need to exploit the authorization bypass?

The attacker must be an authenticated tenant and know the victim's bucket, object, and multipart upload ID. With those identifiers, they can target another tenant's in-progress multipart upload.

Q: What actions can an attacker perform against another tenant's upload?

An attacker can inject upload parts, complete an in-flight upload, or abort it. They can also view multipart-upload and object metadata across tenant boundaries.

Q: What is the remediation?

Upgrade to Rclone v1.75.2 or later. The supplied data does not identify an alternative mitigation for environments that cannot upgrade immediately.

Published Oct 25, 2026

Updated

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

Affected Software

1 affected component

Rclone Rclone>=1.68.0<1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Rclone versions from v1.68.0 through versions before v1.75.2 are affected when using serve s3 with the --auth-proxy option. The issue concerns multipart-upload operations in multi-tenant environments.

What does an attacker need to exploit the authorization bypass?

The attacker must be an authenticated tenant and know the victim's bucket, object, and multipart upload ID. With those identifiers, they can target another tenant's in-progress multipart upload.

What actions can an attacker perform against another tenant's upload?

An attacker can inject upload parts, complete an in-flight upload, or abort it. They can also view multipart-upload and object metadata across tenant boundaries.

What is the remediation?

Upgrade to Rclone v1.75.2 or later. The supplied data does not identify an alternative mitigation for environments that cannot upgrade immediately.

CVE-2026-116187: Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the authorization bypass?

What actions can an attacker perform against another tenant's upload?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the authorization bypass?

What actions can an attacker perform against another tenant's upload?

What is the remediation?