Rclone is a command-line program to sync files and directories to and from different cloud storage providers. (CVE-2026-54572)

Rclone versions prior to 1.74.4 contain multiple security vulnerabilities that were resolved in the 1.74.4 release. The vulnerabilities have a CVSS 3.1 base score of 8.8, indicating a high impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts including low confidentiality, high integrity, and low availability impacts. The vulnerabilities affect various specific package versions across distributions such as Ubuntu and openSUSE. Patches are available as detailed in the referenced GitHub commits.

The vulnerabilities allow an attacker to potentially impact the confidentiality, integrity, and availability of the system running affected rclone versions. The CVSS vector indicates that exploitation can be performed remotely without privileges but requires user interaction. The scope of impact is changed, with low confidentiality impact, high integrity impact, and low availability impact. This could lead to unauthorized data modification or partial service disruption.

A patch is available and should be applied by upgrading to rclone version 1.74.4 or later. The vendor has released fixes as part of the rclone-1.74.4-1.1 package for openSUSE Tumbleweed and other distributions. Users should consult the vendor advisories and apply the updates promptly to remediate these vulnerabilities.