CVE-2026-88015: 
Grafana vulnerability analysis and mitigation

CVE-2026-88015 is a denial-of-service vulnerability in rclone's local backend that allows unauthenticated remote attackers to crash HTTP/WebDAV request handlers by sending a crafted Range header against a symlink-backed object. It affects all rclone versions up to and including 1.75.0 when the --links or links=true configuration option is enabled. The vulnerability was published on September 10, 2026, and patched in version 1.75.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is an unchecked positive Range start value in fs.RangeOption.Decode() (CWE-190: Integer Overflow or Wraparound; CWE-248: Uncaught Exception). When backend/local is configured with --links, symlinks are exposed as .rclonelink objects whose content is the target path string. The RangeOption.Decode() function's Start >= 0 branch sets offset = o.Start with no upper bound check — unlike the suffix-range branch (Start < 0) which already clamps oversized values to 0. This unchecked offset is passed through Object.Open() into openTranslatedLink(), which performs the slice operation linkdst[offset:] directly on the target string. Supplying a start value such as math.MaxInt64 (9223372036854775807) against a short target string deterministically triggers a Go runtime panic (slice bounds out of range). The fix clamps the offset to len(linkdst) before slicing (GitHub Advisory, Fix Commit).

Successful exploitation causes a request-level denial of service: Go's net/http recovers the panic per-connection, terminating the affected request/connection without crashing the entire rclone server process. There is no confidentiality or integrity impact — no data is exposed and no file handles are left open, as the panic occurs before any read handle is acquired. The attack is fully deterministic and requires no authentication, meaning any network-accessible rclone HTTP/WebDAV endpoint with symlinks enabled can be repeatedly disrupted by a single crafted request per connection (GitHub Advisory).

A proof-of-concept is publicly documented in the official GitHub Security Advisory, including specific reproduction steps (sending Range: bytes=9223372036854775807- against a .rclonelink object). The vulnerability is automatable, requires no authentication or user interaction, and is triggered deterministically with a single HTTP request. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is 0.0. The CVE is not listed in the CISA KEV catalog (GitHub Advisory, Red Hat).

1. Reconnaissance: Identify rclone HTTP or WebDAV serve endpoints (default port 5572) exposed over the network. Confirm the target is running rclone < 1.75.1 with backend/local and --links or links=true enabled.
2. Identify symlink objects: Browse or enumerate the served directory to locate .rclonelink objects (symlink-backed files exposed by rclone's local backend with links mode enabled).
3. Craft the malicious request: Construct an HTTP GET request targeting a .rclonelink object URL with a crafted Range header using an extremely large start offset:

   GET /path/to/symlink.txt.rclonelink HTTP/1.1
   Host: <target>:5572
   Range: bytes=9223372036854775807-

4. Trigger the panic: rclone's RangeOption.Decode() passes the unchecked offset (math.MaxInt64) through Object.Open() into openTranslatedLink(), which attempts linkdst[9223372036854775807:] on a short string, causing a Go runtime panic: slice bounds out of range [9223372036854775807:N].
5. Achieve DoS: Go's net/http recovers the panic per-connection, terminating the request handler for that connection. Repeating this request continuously disrupts service for affected clients (GitHub Advisory).

• Network: Repeated HTTP GET requests to .rclonelink object URLs with a Range header containing an extremely large start value (e.g., Range: bytes=9223372036854775807- or similar large integers).
• Logs: rclone server logs showing abrupt connection terminations or HTTP 500 errors on requests to .rclonelink paths; Go runtime panic stack traces referencing backend/local.(*Object).openTranslatedLink and backend/local.(*Object).Open.
• Process: Goroutine-level panics recovered by net/http visible in rclone stderr or log output, specifically mentioning slice bounds out of range with large index values (GitHub Advisory).

Upgrade rclone to version 1.75.1 or later, which clamps the offset to len(linkdst) before slicing, preventing the panic (rclone v1.75.1, Fix Commit). If immediate patching is not possible, disable the --links / -l flag or set links=false in the rclone configuration to prevent symlink targets from being exposed as .rclonelink objects — this eliminates the vulnerable code path entirely. Additionally, restrict network access to rclone HTTP/WebDAV serve endpoints to trusted clients only as a defense-in-depth measure (GitHub Advisory).