There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows
    unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash
    root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen
    hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
    (CVE-2026-116192)

  - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy
    that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their
    upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or
    abort in-flight uploads and view upload and object metadata across tenants. (CVE-2026-116187)

  - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart
    reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent
    current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order
    parts in memory, exhausting the host. (CVE-2026-116188)

  - rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts
    checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the
    release distribution path can prepend an unsigned checksum line matching a malicious archive, causing
    selfupdate to install an attacker-controlled rclone executable. (CVE-2026-116189)

  - rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend
    that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.
    Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via
    --webdav-headers and replay them against the original WebDAV service. (CVE-2026-116190)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - v1.75.2 之前的 Rclone 在 b2 後端包含一個憑證暴露弱點，該弱點會在來自主機的 --b2-download-url HTTP 重新導向時洩漏即時帳戶授權權杖和 SSE-C 金鑰。攻擊者可以觀察到同一主機的 HTTPS 到 HTTP 降級重新導向以擷取純文字 B2 權杖，或接收洩露 SSE-C 客戶加密金鑰的跨主機重新導向。（CVE-2026-116196）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 低于 v1.75.2 的 Rclone 在 b2 后端中包含一个凭据泄露漏洞，可在从主机的 --b2-download-url HTTP 重定向上泄漏实时帐户授权标记和 SSE-C 密钥。攻击者可发现同主机 HTTPS 到 HTTP 降级重定向以捕获明文 B2 标记，或接收泄露 SSE-C 客户加密密钥的跨主机重定向。（CVE-2026-116196）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - v1.75.2 より前の Rclone には、b2 バックエンドに認証情報漏洩の脆弱性があるため、 --b2-download-url ホストからの HTTP リダイレクトでライブアカウント承認トークンおよび SSE-C キーが漏洩します。攻撃者が、同一ホストの HTTPS から HTTP へのダウングレードリダイレクトを観察して、平文の B2 トークンをキャプチャしたり、SSE-C 顧客の暗号化キーを漏洩するクロスホストリダイレクトを受信したりする可能性があります。(CVE-2026-116196)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live     account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can     observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-     host redirects disclosing SSE-C customer encryption keys. (CVE-2026-116196)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/11/2	2026/11/2	high
478183	Alpine: multiple rclone packages: security update to 1.75.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/11/2	2026/11/2	high
371955	Linux Distros 未修補弱點：CVE-2026-116196	Nessus	Misc.	2026/10/26	2026/10/30	medium
371955	Linux Distros 未修补的漏洞：CVE-2026-116196	Nessus	Misc.	2026/10/26	2026/10/30	medium
371955	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116196	Nessus	Misc.	2026/10/26	2026/10/30	medium
371955	Linux Distros Unpatched Vulnerability : CVE-2026-116196	Nessus	Misc.	2026/10/26	2026/10/30	medium

偵測

搜尋 Plugin

high

high

medium

medium

medium

medium