Detections
Analytics

SCA: security update for github.com/rclone/rclone (GHSA-xwwr-4h3p-r22c)

critical Tenable Self-Hosted Container Security Plugin ID 447926

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - rclone is a command-line program to sync files and directories to and from different cloud storage
 providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows
 authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then
 verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access
 key identifier as both the user and authentication value to the proxy without an independent per-identity
 secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an
 empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is
 fixed in version 1.75.1. (CVE-2026-88018)

Solution

Update the github.com/rclone/rclone library and its related packages to version 1.75.1 or later.

See Also

https://github.com/advisories/GHSA-xwwr-4h3p-r22c

Plugin Details

Severity: Critical

ID: 447926

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/11/2026

Updated: 9/11/2026

Risk Information

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-88018

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/10/2026

Vulnerability Publication Date: 9/10/2026

Reference Information

CVE: CVE-2026-88018