Alpine: multiple rclone packages: security update to 1.75.2-r0

high Tenable Self-Hosted Container Security Plugin ID 478183

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows
unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash
root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen
hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
(CVE-2026-116192)

- Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

- rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
parts in memory, exhausting the host. (CVE-2026-116188)

- rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

- rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
--webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Solution

Update the rclone library and its related packages to version 1.75.2-r0 or later.

Plugin Details

Severity: High

ID: 478183

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/2/2026

Updated: 11/2/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.58

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-116192

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-116191

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-116191

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/25/2026

Reference Information

CVE: CVE-2026-116187, CVE-2026-116188, CVE-2026-116189, CVE-2026-116190, CVE-2026-116191, CVE-2026-116192, CVE-2026-116193, CVE-2026-116194, CVE-2026-116195, CVE-2026-116196

Detections

Analytics