•about 1 hour ago•CVE-2026-67309
7.8CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware
A high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the `nginx.ingress.kubernetes.io/rewrite-target` annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.
0 views•7 min read
•about 2 hours ago•CVE-2026-65600
7.8CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware
CVE-2026-65600 is a path traversal vulnerability in the ReplacePathRegex middleware component of Traefik. An unauthenticated remote attacker can exploit the vulnerability to inject directory traversal sequences. When Traefik forwards the resulting un-normalized path, downstream backend web servers normalize the request to execute administrative or protected paths, bypassing gateway-enforced security policies.
1 views•6 min read
•about 3 hours ago•CVE-2026-54763
10.0CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies
A critical authentication bypass and context spoofing vulnerability exists in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares prior to versions 2.11.51, 3.6.22, and 3.7.6. The flaw arises because Traefik's header cleanup mechanisms rely on Go's standard library header canonicalization, which does not modify or delete headers containing underscores. Consequently, unauthenticated remote attackers can inject custom underscore-variant headers (e.g., X_Auth_User) that bypass Traefik's stripping filters and reach backend application servers. When downstream backends normalize both hyphens and underscores into the same environment variables, the attacker's spoofed identity value is processed as trusted authorization data.
3 views•7 min read
•about 4 hours ago•CVE-2026-71324
7.0CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling
CVE-2026-71324 is a high-severity HTTP request smuggling vulnerability in the Traefik reverse proxy. It allows an unauthenticated remote attacker to achieve cross-user response poisoning when Traefik is configured to route HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream backend. By sending a crafted CONNECT request that is subsequently rejected by the backend with a keep-alive non-2xx response, the attacker can leave smuggled requests within the shared connection pool, which are then served to subsequent clients.
3 views•7 min read
•about 5 hours ago•GHSA-3X6R-WXXG-53VV
5.3GHSA-3x6r-wxxg-53vv: Process-Fatal Nil Pointer Dereference in rclone WebDAV TUS Upload Backend
A critical process-fatal NULL pointer dereference vulnerability exists in the WebDAV backend of rclone (when configured with ownCloud Infinite Scale TUS uploads). During transport failures, a nil HTTP response pointer is dereferenced directly without validation, leading to an unhandled Go runtime panic that terminates the entire rclone daemon. This vulnerability was resolved in rclone version 1.75.0.
2 views•11 min read
•about 6 hours ago•GHSA-8V25-V8P6-QF7V
8.6GHSA-8V25-V8P6-QF7V: Path Traversal in rclone S3 API Gateway Emulation
A path traversal vulnerability exists in the S3 emulation layer of rclone when executing the 'serve s3' subcommand. Because the application maps client-supplied S3 object keys containing relative directory sequences to file paths without proper boundary checks, an attacker can escape the logical containment of a target bucket. This enables unauthorized reading, writing, and deletion of files at the root level of the served storage directory.
3 views•5 min read
•about 7 hours ago•GHSA-8MXV-9XHP-86H4
5.3GHSA-8MXV-9XHP-86H4: Information Disclosure and Credential Leakage during S3 HTTP Redirects in rclone
A critical security flaw was identified in rclone before version 1.75.0, where the custom S3 redirect handler failed to sanitize sensitive authentication headers and encryption keys during cross-host redirects or transport downgrades. This flaw allows attackers on the path or controlling target hosts to intercept sensitive IBM IAM tokens, AWS S3 Express tokens, and customer-provided server-side encryption keys (SSE-C).
3 views•7 min read
•about 8 hours ago•CVE-2026-71311
6.4CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend
A protocol-level CRLF injection vulnerability exists in rclone's FTP backend before version 1.75.0. When configured with a non-default filename encoding, rclone allows carriage return and line feed characters to pass directly into the underlying FTP client library. Because the library constructs line-oriented control commands without input validation, an attacker-controlled filename can inject arbitrary FTP commands into the session, allowing unauthorized file deletion and modification on the target server.
6 views•6 min read
•about 9 hours ago•GHSA-H4MF-4V27-HGGJ
7.4GHSA-H4MF-4V27-HGGJ: WebDAV Credential Disclosure via Same-Host HTTPS-to-HTTP Redirect in rclone
A protocol downgrade vulnerability in rclone's WebDAV backend allows sensitive credentials, cookies, and authentication headers to be transmitted in cleartext. This occurs when a remote server redirects an HTTPS request to a plaintext HTTP URL on the same host, which the Go HTTP client default behavior permits without checking the protocol transport layer. This report provides a detailed technical analysis of the root cause, exploit mechanics, patch diff, and remediation strategies.
4 views•7 min read
•about 10 hours ago•CVE-2026-71312
8.0CVE-2026-71312: OS Command Injection via Unicode Smart Quote Shell Bypass in rclone SFTP Backend
An incomplete sanitization vulnerability exists in rclone's SFTP backend before version 1.75.0 when performing server-side hashing operations on Windows hosts. Due to PowerShell treating Unicode smart quotes as equivalent to ASCII single quotes, malicious file paths can escape command string delimiters and execute arbitrary commands on the remote system.
4 views•9 min read
•about 11 hours ago•CVE-2026-59733
8.8CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic
A critical path traversal and authorization bypass vulnerability exists in the rclone serve restic command when multi-user isolation is enabled using the --private-repos flag. Due to a middleware desynchronization flaw, authenticated users can access, modify, or delete backup repositories belonging to other tenants.
4 views•5 min read
•about 12 hours ago•GHSA-GX4C-2HQX-CW2R
3.1GHSA-gx4c-2hqx-cw2r: Cleartext Transmission of Sensitive AWS STS Tokens in rclone S3 Backend via Scheme Downgrade Redirects
A logic vulnerability in the rclone S3 backend implementation allows an unauthenticated adjacent-network attacker to intercept temporary AWS STS credentials. During HTTP redirection handling, the application fails to verify whether a protocol scheme change occurred (such as transitioning from HTTPS to HTTP). If a secure request is redirected to an unencrypted endpoint on the same host, rclone continues to forward the highly sensitive X-Amz-Security-Token header in cleartext.
4 views•6 min read