rclone CVE-2026-88015

Two non-default configuration conditions must both be present: (1) rclone must be running in HTTP or WebDAV serve mode (invoked as rclone serve http or rclone serve webdav), and (2) symlink translation must be explicitly enabled via the --links flag or links=true in the backend config - neither is enabled by default. Additionally, the attacker must have network access to the rclone HTTP/WebDAV endpoint and must be able to address a .rclonelink-suffixed object within the served path. Exploitation is strictly limited to per-connection denial of service; the rclone process continues to operate and handle other connections, and there is no confidentiality or integrity impact regardless of configuration.

The provided CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the mechanics: the endpoint is network-exposed, requires no authentication, and produces only low-severity availability impact because the process continues running. Two non-default conditions must hold simultaneously - rclone must be in HTTP/WebDAV serve mode and symlink translation must be enabled - which meaningfully narrows the real-world attack surface compared to the raw CVSS score implies. No EPSS data is provided; given the niche configuration dependency, exploitation probability is expected to be low. No active exploitation has been confirmed (not in CISA KEV) and no POC code is publicly known beyond the GitHub advisory description. Overall this is a genuine but low-operational-urgency finding: patching is straightforward and the worst-case impact is disruption to individual HTTP connections, not process termination or data exposure.

An attacker discovers a rclone HTTP server (via port scanning or service enumeration) that is running with --links enabled. They browse or guess the path of a .rclonelink object - for example GET /symlink.txt.rclonelink - and replay requests with Range: bytes=999999- headers where 999999 exceeds any realistic symlink target length. Each such request triggers a slice-bounds panic in openTranslatedLink, which Go's runtime recovers per-connection while returning a 500 error to the client; repeated requests degrade service for legitimate users without ever crashing the rclone process.