There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated
    attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send
    MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files
    belonging to other tenants. (CVE-2026-116191)

  - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
    that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
    upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
    abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
    reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
    current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
    parts in memory, exhausting the host. (CVE-2026-116188)

  - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
    checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
    release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
    selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - rclone from v1.56.0 before v1.75.2 在 WebDAV 后端中包含信息泄露漏洞，会在 HTTP 3xx 重定向时将操作员配置的自定义凭据标头转发到不同主机。
    控制或影响跨主机重定向的攻击者可通过
    --webdav-headers 并根据原始 WebDAV 服务重放它们。（CVE-2026-116190）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - v1.56.0 至 v1.75.2 之前的 rclone 在 WebDAV 後端包含資訊洩漏弱點，可將操作員配置的自訂認證標頭轉送至 HTTP 3xx 重新導向上的不同主機。
    控制或影響跨主機重新導向的攻擊者可擷取標頭，例如透過
    --webdav-headers 並針對原始 WebDAV 服務重播它們。（CVE-2026-116190）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - v1.75.2 より前の v1.56.0 からの rclone には、WebDAV バックエンドに情報漏洩の脆弱性があります。これにより、オペレーターが構成したカスタム認証情報ヘッダーが、HTTP 3xx リダイレクトの別のホストに転送されます。
    クロスホストリダイレクトを制御または影響を与える攻撃者は、を介して X-Auth-Token セットなどのヘッダーをキャプチャできます。
    --webdav-headers 元のWebDAVサービスに対してそれらを再生します。(CVE-2026-116190)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend     that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
478379	Echo: rclone: security update to 1.75.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	11/5/2026	11/5/2026	medium
478379	Echo: rclone: security update to 1.75.2	Tenable Cloud Security	Echo Local Security Checks	11/5/2026	11/5/2026	medium
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
371962	Linux Distros 未修补的漏洞：CVE-2026-116190	Nessus	Misc.	10/26/2026	10/30/2026	medium
371962	Linux Distros 未修補弱點：CVE-2026-116190	Nessus	Misc.	10/26/2026	10/30/2026	medium
371962	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116190	Nessus	Misc.	10/26/2026	10/30/2026	medium
371962	Linux Distros Unpatched Vulnerability : CVE-2026-116190	Nessus	Misc.	10/26/2026	10/30/2026	medium

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

medium

medium

medium