There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated
    attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send
    MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files
    belonging to other tenants. (CVE-2026-116191)

  - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
    that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
    upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
    abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
    reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
    current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
    parts in memory, exhausting the host. (CVE-2026-116188)

  - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
    checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
    release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
    selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live
    account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can
    observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-
    host redirects disclosing SSE-C customer encryption keys. (CVE-2026-116196)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - v1.75.2 之前的 Rclone 在 b2 後端包含一個憑證暴露弱點，該弱點會在來自主機的 --b2-download-url HTTP 重新導向時洩漏即時帳戶授權權杖和 SSE-C 金鑰。攻擊者可以觀察到同一主機的 HTTPS 到 HTTP 降級重新導向以擷取純文字 B2 權杖，或接收洩露 SSE-C 客戶加密金鑰的跨主機重新導向。（CVE-2026-116196）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 低于 v1.75.2 的 Rclone 在 b2 后端中包含一个凭据泄露漏洞，可在从主机的 --b2-download-url HTTP 重定向上泄漏实时帐户授权标记和 SSE-C 密钥。攻击者可发现同主机 HTTPS 到 HTTP 降级重定向以捕获明文 B2 标记，或接收泄露 SSE-C 客户加密密钥的跨主机重定向。（CVE-2026-116196）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - v1.75.2 より前の Rclone には、b2 バックエンドに認証情報漏洩の脆弱性があるため、 --b2-download-url ホストからの HTTP リダイレクトでライブアカウント承認トークンおよび SSE-C キーが漏洩します。攻撃者が、同一ホストの HTTPS から HTTP へのダウングレードリダイレクトを観察して、平文の B2 トークンをキャプチャしたり、SSE-C 顧客の暗号化キーを漏洩するクロスホストリダイレクトを受信したりする可能性があります。(CVE-2026-116196)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live     account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can     observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-     host redirects disclosing SSE-C customer encryption keys. (CVE-2026-116196)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
478370	Echo: rclone: security update to 1.75.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	11/5/2026	11/5/2026	medium
478370	Echo: rclone: security update to 1.75.2	Tenable Cloud Security	Echo Local Security Checks	11/5/2026	11/5/2026	medium
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/2/2026	11/5/2026	high
371955	Linux Distros 未修補弱點：CVE-2026-116196	Nessus	Misc.	10/26/2026	10/30/2026	medium
371955	Linux Distros 未修补的漏洞：CVE-2026-116196	Nessus	Misc.	10/26/2026	10/30/2026	medium
371955	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116196	Nessus	Misc.	10/26/2026	10/30/2026	medium
371955	Linux Distros Unpatched Vulnerability : CVE-2026-116196	Nessus	Misc.	10/26/2026	10/30/2026	medium

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

medium

medium

medium