CVE-2026-116189: rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

Q: Which installations are exposed to this issue?

rclone versions from 1.55.0 up to, but not including, 1.75.2 are affected when using the stable selfupdate mechanism. The issue concerns verification of the SHA256SUMS data used during selfupdate.

Q: What must an attacker be able to do to exploit it?

An attacker must control the release distribution path used by selfupdate. They can prepend an unsigned checksum for a malicious archive before the PGP-clearsigned SHA256SUMS block, leading selfupdate to accept and install an attacker-controlled executable.

Q: Is user interaction required?

Yes. The supplied vector identifies user interaction as required. Exploitation also depends on the affected installation performing a stable selfupdate through an attacker-controlled release distribution path.

Q: How can I determine whether a system may be affected?

Check whether the installed rclone version is 1.55.0 or later and earlier than 1.75.2, and whether stable selfupdate is used. Systems that did not use the affected selfupdate path are not described as exposed by the provided information.

Published Oct 25, 2026

Updated

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

Affected Software

1 affected component

Rclone Rclone>=1.55.0<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed to this issue?

rclone versions from 1.55.0 up to, but not including, 1.75.2 are affected when using the stable selfupdate mechanism. The issue concerns verification of the SHA256SUMS data used during selfupdate.

What must an attacker be able to do to exploit it?

An attacker must control the release distribution path used by selfupdate. They can prepend an unsigned checksum for a malicious archive before the PGP-clearsigned SHA256SUMS block, leading selfupdate to accept and install an attacker-controlled executable.

Is user interaction required?

Yes. The supplied vector identifies user interaction as required. Exploitation also depends on the affected installation performing a stable selfupdate through an attacker-controlled release distribution path.

How can I determine whether a system may be affected?

Check whether the installed rclone version is 1.55.0 or later and earlier than 1.75.2, and whether stable selfupdate is used. Systems that did not use the affected selfupdate path are not described as exposed by the provided information.

CVE-2026-116189: rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are exposed to this issue?

What must an attacker be able to do to exploit it?

Is user interaction required?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to this issue?

What must an attacker be able to do to exploit it?

Is user interaction required?

How can I determine whether a system may be affected?