UBUNTU-CVE-2026-116189: High severity ubuntu/rclone vulnerability
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ubuntu systems using rclone versions from 1.55.0 up to, but not including, 1.75.2 are affected when the stable selfupdate mechanism is used. Systems that do not use selfupdate are not described as being exposed through this vulnerability.
What does an attacker need to exploit the vulnerability?
An attacker must control the release distribution path and induce a user to run the selfupdate process. They can prepend an unsigned checksum for a malicious archive before the PGP-clearsigned SHA256SUMS block, causing selfupdate to install an attacker-controlled executable.
Is user interaction required?
Yes. The published vector includes UI:R, and exploitation depends on the selfupdate process being run to install the malicious archive.
What is the immediate mitigation if upgrading is not possible?
Avoid using rclone's stable selfupdate mechanism until rclone can be updated to version 1.75.2 or later. Obtain and verify updates through a trusted distribution path instead.