CVE-2026-116192: rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Q: Which deployments are exposed to this issue?

Deployments using rclone versions from 1.37 before 1.74.2 are affected when --rc-serve is used with an existing named http or netstorage remote. The issue concerns requests made through those backends.

Q: Does exploitation require credentials or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, although the attack complexity is rated high.

Q: What could an attacker obtain through exploitation?

An attacker can cause HEAD or GET requests to attacker-chosen hosts and read the responses. They may also capture configured custom headers or obtain valid NetStorage request signatures.

Q: How can I assess whether an instance needs remediation?

Check whether the rclone version is from 1.37 through versions before 1.74.2, whether it is run with --rc-serve, and whether named http or netstorage remotes exist. Instances meeting these conditions should be treated as affected.

Published Oct 25, 2026

Updated

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

Affected Software

1 affected component

Rclone Rclone>=1.37<1.74.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone to a version that resolves this vulnerability.
Fixed in 1.74.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using rclone versions from 1.37 before 1.74.2 are affected when --rc-serve is used with an existing named http or netstorage remote. The issue concerns requests made through those backends.

Does exploitation require credentials or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, although the attack complexity is rated high.

What could an attacker obtain through exploitation?

An attacker can cause HEAD or GET requests to attacker-chosen hosts and read the responses. They may also capture configured custom headers or obtain valid NetStorage request signatures.

How can I assess whether an instance needs remediation?

Check whether the rclone version is from 1.37 through versions before 1.74.2, whether it is run with --rc-serve, and whether named http or netstorage remotes exist. Instances meeting these conditions should be treated as affected.

CVE-2026-116192: rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require credentials or user interaction?

What could an attacker obtain through exploitation?

How can I assess whether an instance needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require credentials or user interaction?

What could an attacker obtain through exploitation?

How can I assess whether an instance needs remediation?