There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated
    attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send
    MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files
    belonging to other tenants. (CVE-2026-116191)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated
    attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send
    MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files
    belonging to other tenants. (CVE-2026-116191)

  - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
    that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
    upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
    abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
    reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
    current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
    parts in memory, exhausting the host. (CVE-2026-116188)

  - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
    checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
    release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
    selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 之前的 Rclone 在 1.75.2 serve webdav 中包含一个路径遍历漏洞，允许未经认证的攻击者通过发送未经验证的“..”路径组件在服务的根之上写入。攻击者可发送 MKCOL /..以植入 VFS 节点，然后通过 PUT、MOVE、COPY 或 MKCOL 创建、覆盖或删除属于其他租户的文件。（CVE-2026-116191）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - rclone 之前 1.75.2 在 serve webdav 中包含一個路徑遊走弱點，允許未經驗證的攻擊者透過傳送未經驗證的「..」路徑元件來寫入服務的根目錄上方。攻擊者可以發送 MKCOL /..以植入 VFS 節點，然後使用 PUT、MOVE、COPY 或 MKCOL 來建立、覆寫或刪除屬於其他租用戶的檔案。（CVE-2026-116191）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 1.75.2 より前の Rclone には、serve webdav にパストラバーサルの脆弱性があります。これにより、認証されていない攻撃者が、検証されていない「..」パスコンポーネントを送信することで、serve root の上に書き込む可能性があります。攻撃者が MKCOL/.を送信する可能性があります。VFS ノードを配置してから、PUT、MOVE、COPY、または MKCOL を使用して、他のテナントに属するファイルを作成、上書き、または削除します。(CVE-2026-116191)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4081 advisory.

    rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts     checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the     release distribution path can prepend an unsigned checksum line matching a malicious archive, causing     selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

    Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated     attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send     MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files     belonging to other tenants. (CVE-2026-116191)

    When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate     the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs     memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a Trailer header     that declares a large number of fields causing the server to allocate a disproportionate amount of memory     while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.This exploit is not applicable     for HTTP/1 servers, which do not support  multiplexing a large number of requests over one TCP connection,     and whose Server.MaxHeaderBytes are calculated differently.Server.MaxHeaderValueCount and     Server.MaxHeaderBytes limits are now applied towards the trailer fields declared in Trailer headers.

    NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9NOTE:
    https://github.com/golang/go/issues/81857NOTE: Fixed by:
    https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)NOTE: Fixed by:
    https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9) (CVE-2026-78659)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3401 advisory.

    rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart     reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent     current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order     parts in memory, exhausting the host. (CVE-2026-116188)

    rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts     checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the     release distribution path can prepend an unsigned checksum line matching a malicious archive, causing     selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

    Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated     attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send     MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files     belonging to other tenants. (CVE-2026-116191)

    When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate     the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs     memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a Trailer header     that declares a large number of fields causing the server to allocate a disproportionate amount of memory     while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.This exploit is not applicable     for HTTP/1 servers, which do not support  multiplexing a large number of requests over one TCP connection,     and whose Server.MaxHeaderBytes are calculated differently.Server.MaxHeaderValueCount and     Server.MaxHeaderBytes limits are now applied towards the trailer fields declared in Trailer headers.

    NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9NOTE:
    https://github.com/golang/go/issues/81857NOTE: Fixed by:
    https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)NOTE: Fixed by:
    https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9) (CVE-2026-78659)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated     attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send     MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files     belonging to other tenants. (CVE-2026-116191)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478394	Echo: rclone: security update to 1.75.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	11/5/2026	11/5/2026	high
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
478394	Echo: rclone: security update to 1.75.2	Tenable Cloud Security	Echo Local Security Checks	11/5/2026	11/5/2026	high
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
371970	Linux Distros 未修补的漏洞：CVE-2026-116191	Nessus	Misc.	10/26/2026	10/30/2026	high
371970	Linux Distros 未修補弱點：CVE-2026-116191	Nessus	Misc.	10/26/2026	10/30/2026	high
371970	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116191	Nessus	Misc.	10/26/2026	10/30/2026	high
377945	Amazon Linux 2 : rclone (ALAS-2026-4081)	Nessus	Amazon Linux Local Security Checks	11/9/2026	11/9/2026	high
377961	Amazon Linux 2023 : rclone (ALAS2023-2026-3401)	Nessus	Amazon Linux Local Security Checks	11/9/2026	11/9/2026	high
371970	Linux Distros Unpatched Vulnerability : CVE-2026-116191	Nessus	Misc.	10/26/2026	10/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high