HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-116189 — rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in sta...

·Source: NIST NVD

Updated:

Executive Summary

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

Analysis

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable. CVSS Score: 7.5. Published: 2026-10-25T14:16:59.120.

Indicators of Compromise (1)

CVE (1)
CVE-2026-116189
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 25, 2026. Verified by: NIST.

Related Threats

HIGHRansomware

Hospital Ransomware Attacker Receives 70 Month Jail Term

A Ukrainian affiliate of the Nefilim & Hive ransomware operations who attacked hospitals, government entities, and businesses over a three-year […] The post Hospital Ransomware Attacker Receives 70 Month Jail Term appeared first on The HIPAA Journal .

HIPAA Journal
CRITICALVulnerability

NVD CRITICAL: CVE-2026-118690 — Signal K Server before 2.33.0 contains a missing authentication vulnerability th...

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

CVE-2026-118690
NIST NVD
HIGHRansomware

Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems

A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.

Graham Cluley