There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated
    attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send
    MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files
    belonging to other tenants. (CVE-2026-116191)

  - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
    that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
    upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
    abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
    reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
    current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
    parts in memory, exhausting the host. (CVE-2026-116188)

  - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
    checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
    release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
    selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - rclone 服务于 S3 之前1.75.2的1.75.0版本在多部分 reorder-memory 核算中包含整数溢出漏洞，可绕过配置的缓冲区限制。攻击者可并发打开两个并发的当前部分 PUT 请求，声明巨大长度以封装已签名的 int64 计数器，并将乱序部分保留在内存中，从而耗尽主机。（CVE-2026-116188）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - rclone 服務 s3 版本 1.75.0 之前 1.75.2 包含 multipart reorder-memory 帳戶中的整數溢位弱點，會繞過設定的緩衝區限制。攻擊者可以打開兩個並發的當前部分 PUT 請求，聲明大量長度來包裝已簽名的 int64 計數器，並將無序部分保留在記憶體中，從而耗盡主機。（CVE-2026-116188）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - rclone serve 1.75.2 より前の S3 1.75.0バージョンには、マルチパートの並べ替えメモリアカウンティングに、構成されたバッファ制限をバイパスする整数オーバーフローの脆弱性が含まれています。攻撃者が、署名付きの int64 カウンターをラップし、メモリ内の順序の乱れた部分を保持してホストを使い果たすための膨大な長さを宣言する 2 つの同時部分の PUT リクエストを開くことができます。(CVE-2026-116188)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3401 advisory.

    rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart     reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent     current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order     parts in memory, exhausting the host. (CVE-2026-116188)

    rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts     checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the     release distribution path can prepend an unsigned checksum line matching a malicious archive, causing     selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

    Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated     attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send     MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files     belonging to other tenants. (CVE-2026-116191)

    When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate     the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs     memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a Trailer header     that declares a large number of fields causing the server to allocate a disproportionate amount of memory     while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.This exploit is not applicable     for HTTP/1 servers, which do not support  multiplexing a large number of requests over one TCP connection,     and whose Server.MaxHeaderBytes are calculated differently.Server.MaxHeaderValueCount and     Server.MaxHeaderBytes limits are now applied towards the trailer fields declared in Trailer headers.

    NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9NOTE:
    https://github.com/golang/go/issues/81857NOTE: Fixed by:
    https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)NOTE: Fixed by:
    https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9) (CVE-2026-78659)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart     reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent     current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order     parts in memory, exhausting the host. (CVE-2026-116188)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
371947	Linux Distros 未修补的漏洞：CVE-2026-116188	Nessus	Misc.	10/26/2026	10/30/2026	medium
371947	Linux Distros 未修補弱點：CVE-2026-116188	Nessus	Misc.	10/26/2026	10/30/2026	medium
371947	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116188	Nessus	Misc.	10/26/2026	10/30/2026	medium
377961	Amazon Linux 2023 : rclone (ALAS2023-2026-3401)	Nessus	Amazon Linux Local Security Checks	11/9/2026	11/9/2026	high
371947	Linux Distros Unpatched Vulnerability : CVE-2026-116188	Nessus	Misc.	10/26/2026	10/30/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

high

medium