VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/rclone/rclone: vulnerability history, versions and safety

github.com/rclone/rclone is a package in the Go ecosystem. Vulert records 57 vulnerabilities for it across 120 releases, from Jun 2021 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
57 vulnerabilities recorded C5 H7 M13 L4 U28
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
53 in the last 12 months

Most recent disclosure 16 Sep 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/rclone/rclone vulnerabilities

Vulert verdict on github.com/rclone/rclone v1.75.2 i

Updated on 23 Oct 2026

Action needed: v1.75.2 has 38 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 66/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.75.2 — affected i
  • Vulnerabilities on record 57 over 5 years · 53 in the last year i
  • Latest disclosure 16 Sep 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 0 i
  • Stars 60,307 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/rclone/rclone, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.75.1-0.20261020101718-81e7372f6fbe 20 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261019193038-57833ef11d81 19 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261018171739-0c9826d3440d 18 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261018163927-0677b0ca1eee 18 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261017164025-35a03a47e00e 17 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261016164349-4c52ae057564 16 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261015164149-d369079a1448 15 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261015091047-f2bb215ce5cf 15 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261014194218-be46eaa1f0fe 14 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261014160721-5f0e72c03f8e 14 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261014113616-e18da083728b 14 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261014110751-ae39ec6f6459 14 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261014083825-a96a8b77579c 14 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261013111946-4983d291e66c 13 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261009114147-4f19e9cd6f44 09 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261009110635-16d355a046cf 09 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.2 09 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261008155158-91ab88aeb17e 08 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261007111642-408cc55171b6 07 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261006112302-aeb98f931609 06 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261005104224-3b9f0a05b55f 05 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261004071402-7ebef790b49a 04 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261003152730-a82c965ba1a2 03 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261003150624-5e0a42c7c5ef 03 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20261002144425-9e27583e8045 02 Oct 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260930165747-0b8e9c4ccdec 30 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v0.0.0-20260929172123-666d67f0eb8f 29 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260929172123-666d67f0eb8f 29 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260926133907-9dc8b71ae994 26 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260925161108-94e319d2fa87 25 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260924093610-ce5351c52e94 24 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260923150438-3ac301eff1f7 23 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260922164458-cfb90e3ebed4 22 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260921165043-48da73ad5a5c 21 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260921112631-7723091be979 21 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260920132350-1c3e432c3fdb 20 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260920091103-b5f83bdbf29a 20 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260916160939-c8d60a67fc53 16 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260915154533-976d05e1ddf5 15 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260915111022-0cb6ddada9c3 15 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260914083433-3342e34f583d 14 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260912113650-812e693fd787 12 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260911041621-c3ba184611c3 11 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260910155715-7b3a4e514450 10 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260909093819-ef6968730fc5 09 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260908095105-c875d8903390 08 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260905165308-3d7b101c7f4b 05 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260905111532-e855d2ed36b6 05 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260905110236-1b4dea8dac20 05 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904180022-1615434cbe76 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904180022-6453374403af 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904180022-73119d368f26 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904180022-935197b06220 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151835-22859b7e696c 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151835-6507e13d5a83 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151835-79fbc0842f74 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151835-925fb4fb21eb 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-17b0c03338a8 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-28bf49d66f94 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-7a594b09c6ed 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-90595f34f27f 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-a7ab39d3d195 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-c6af0b57c2b4 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151819-f376c6478474 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151818-1bec2133c54d 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151818-b3cf0444a2a3 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260904151818-f18aacf2c753 04 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260903110627-b4c598dbe4a8 03 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260902224707-7e17e1b90d89 02 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260901132529-58c2b1b35250 01 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260901132152-220fe7619215 01 Sep 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260830161301-4479a3b09bea 30 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260828194512-55fa9b6ab2b7 28 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260828163851-e5e1ee3e9680 28 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260827162804-1583cce1e283 27 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260826164257-9dbfd9d85231 26 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260826132637-660144d311ef 26 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260826110958-c140d36a1f37 26 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260825083252-8869a848f229 25 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260824171612-bee45bccfd54 24 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260821165341-64ab1ac32260 21 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260821115212-be7f9b38b053 21 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v0.0.0-20260819111500-2f7d4e3f9f5b 19 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260819111500-2f7d4e3f9f5b 19 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260818112935-2c1174af0dfd 18 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260814181826-f0b210a886dd 14 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260812095944-cfdc9d05584f 12 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260811202734-8b42a38e9d74 11 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260809003949-387b4b5e11d6 09 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260807152843-1aa9efef17ea 07 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260806165242-e4c7aca6bda5 06 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260803203530-6cb4732cc349 03 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260802172509-3f9d583cffd9 02 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260801114442-1d03a771727b 01 Aug 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.1-0.20260731172136-39d8e83a12c0 31 Jul 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.75.0 31 Jul 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v0.0.0-20260731122159-208d7df87758 31 Jul 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v0.0.0-20260731122159-5871d98c3687 31 Jul 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.74.1-0.20260731122159-1df2b7075328 31 Jul 2026 C1 H4 M10 L3 U20 MIT Yes Details →
v1.74.1-0.20260731122159-208d7df87758 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-21d8cd3b92cd 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-31f385628146 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-50b4d4c74570 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-5871d98c3687 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-59b513b0e74f 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-6a69713864b1 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-7543a7a87884 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-9328763d1b73 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-cc5a189f00ef 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-e122fba1a576 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260731122159-ff43a1e3ae17 31 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260730190118-92fbc85f108b 30 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260730100225-f47ea6eb4a32 30 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260729192913-bd4c6571ecdb 29 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260729184245-e8ff1b123b27 29 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260728170358-17629d67b269 28 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260728110754-631bd09ce4be 28 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260727153508-b6ffdfa8e634 27 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →
v1.74.1-0.20260725174831-2217d3827371 25 Jul 2026 C1 H4 M10 L3 U20 — Yes Details →

The newest 120 of 4,093 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2024 3
  • 2026 53

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 53 of the 57 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/rclone/rclone

The 5 most severe of 57 vulnerabilities recorded for this package

Search all 57 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-49980: Rclone Unauthenticated Command Execution via Inline Remote Instantiation 9.8 critical 1.74.3 16 Jun 2026
CVE-2026-88018: rclone Critical Vulnerability in S3 Serve with Auth Proxy Bypass 9.8 critical 1.75.1 10 Sep 2026
CVE-2026-41176: Rclone Unauthenticated Options/Set Allows Runtime Auth Bypass 9.2 critical 1.73.5 22 Apr 2026
CVE-2026-41179: RClone Unauthenticated Operations/FSInfo Allows Command Execution 9.2 critical 1.73.5 22 Apr 2026
CVE-2026-88044: rclone Critical RC Per-Server Auth-Proxy Bypass Vulnerability 9.1 critical 1.75.1 10 Sep 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/rclone/rclone

Is github.com/rclone/rclone safe to use?

Vulert records 57 vulnerabilities for github.com/rclone/rclone in Go: 5 critical, 7 high, 13 medium and 4 low, plus 28 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/rclone/rclone's Vulert package health score?

Vulert scores github.com/rclone/rclone 66/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/rclone/rclone affected?

Yes. v1.75.2, the version you would install today, has 38 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/rclone/rclone should I use?

v1.75.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/rclone/rclone have?

57 vulnerabilities are recorded for github.com/rclone/rclone in the Go ecosystem: 5 critical, 7 high, 13 medium and 4 low, plus 28 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/rclone/rclone vulnerabilities disclosed?

53 vulnerabilities were recorded for github.com/rclone/rclone in the last 12 months, and the oldest entry in this database dates to 10 Jun 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/rclone/rclone are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/rclone/rclone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/rclone/rclone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.