UBUNTU-CVE-2026-116194: High severity ubuntu/rclone vulnerability

Published Oct 25, 2026

Updated

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.

Affected Software

6 affected components

ubuntu/rclone*

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Rclone versions from 1.52.0 through before 1.75.2 are exposed when using the pCloud backend’s OAuth authorization flow. Exploitation requires the user to be performing authorization and to visit a malicious web page.

What must an attacker do to exploit it?

An attacker must induce the user’s browser to send a stateless request to the localhost OAuth callback on port 53682 during authorization. This can plant attacker-controlled tokens and API host settings, causing later transfers to be sent to the attacker.

Are transfers affected immediately after a malicious callback request?

The malicious request targets the authorization process, but the impact occurs on later transfers after attacker tokens and API hosts have been planted. The issue does not affect transfers solely because Rclone is installed; the vulnerable pCloud authorization flow must be involved.

How can I mitigate the issue if I cannot update immediately?

Avoid authorizing the pCloud backend while using an unpatched Rclone version, particularly when browsing untrusted web content during authorization. Upgrade to Rclone 1.75.2 or later when possible.

UBUNTU-CVE-2026-116194: High severity ubuntu/rclone vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Are transfers affected immediately after a malicious callback request?

How can I mitigate the issue if I cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Are transfers affected immediately after a malicious callback request?

How can I mitigate the issue if I cannot update immediately?