CVE-2026-93987 Overview
CVE-2026-93987 is a path traversal vulnerability [CWE-73] in the rclone serve docker volume plugin. Affected versions include rclone 1.56.0 through 1.75.0. The flaw exists in newVolume() within cmd/serve/docker/volume.go, which builds a mountpoint by joining the plugin root with an attacker-supplied volume name. Because the join result is never validated to remain inside drv.root, a name containing .. sequences escapes the base directory /var/lib/docker-volumes/rclone. Any client that can send a VolumeDriver.Create request to the plugin socket can direct the privileged rclone process to create directories and mount remote filesystems at arbitrary host paths. The issue is fixed in rclone 1.75.1.
Critical Impact
Attackers who can submit Docker volume create requests can force the privileged rclone plugin to mount remote filesystems over sensitive host directories such as /etc, shadowing or disrupting system files.
Affected Products
- rclone 1.56.0 through 1.75.0 (rclone serve docker plugin)
- Deployments exposing the rclone Docker VolumeDriver plugin socket to the Docker daemon
- Multi-tenant orchestration environments where workloads can request named Docker volumes
Discovery Timeline
- 2026-09-19 - CVE-2026-93987 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93987
Vulnerability Analysis
The rclone Docker volume plugin implements the Docker VolumeDriver API and creates on-disk mountpoints for each named volume. When Docker sends a VolumeDriver.Create request, newVolume() computes the mountpoint as filepath.Join(drv.root, name) using the volume name field supplied by the caller. filepath.Join cleans path separators but does not confine the result to drv.root. Passing a name such as ../../../../../../etc produces a resolved path outside the plugin's base directory. checkMountpoint() then invokes file.MkdirAll on that path and proceeds to mount the remote backend specified in the same request. Volume.restoreState() performs the same operation when reloading persisted volume state, so a poisoned state file re-triggers the traversal on plugin restart.
Root Cause
The root cause is missing containment validation after path joining. Neither newVolume() nor restoreState() verifies that the computed mountpoint is a descendant of drv.root before creating directories and mounting a remote filesystem.
Attack Vector
Exploitation requires the ability to send a VolumeDriver.Create request to the rclone plugin socket. In a standard single-tenant Docker host this means a caller that already controls the Docker daemon. In multi-tenant orchestration, any workload permitted to create named volumes referencing the rclone driver can supply a traversal payload in the volume name and choose the remote backend to mount at the resulting host path.
No verified exploit code is published. See the GitHub Security Advisory and the VulnCheck Advisory: Rclone Path Traversal for the maintainers' technical description.
Detection Methods for CVE-2026-93987
Indicators of Compromise
- Directories created under sensitive host paths such as /etc, /bin, /usr, or /var with ownership matching the rclone plugin process.
- Entries in the rclone plugin persisted state file containing volume names with .. sequences.
- Unexpected FUSE or remote-backend mounts visible in /proc/self/mountinfo outside /var/lib/docker-volumes/rclone.
Detection Strategies
- Audit rclone plugin logs for VolumeDriver.Create requests whose name field contains .., /, or resolves outside drv.root.
- Compare running mounts against the expected base directory and alert on any rclone-managed mount located elsewhere on the filesystem.
- Inventory installed rclone versions across hosts and flag any release between 1.56.0 and 1.75.0 where the Docker volume plugin is enabled.
Monitoring Recommendations
- Enable file integrity monitoring on system directories such as /etc, /bin, /sbin, and /usr to catch shadowing mounts.
- Monitor Docker API calls that create volumes with the rclone driver and record the caller identity and volume name.
- Alert on rclone plugin restarts followed by new mounts outside the plugin base directory, which may indicate restoreState() reprocessing a malicious persisted entry.
How to Mitigate CVE-2026-93987
Immediate Actions Required
- Upgrade rclone to version 1.75.1 or later on all hosts running rclone serve docker.
- Stop the rclone Docker plugin on unpatched systems until the upgrade is applied.
- Inspect the plugin's persisted state file and remove any entries whose volume names contain path traversal sequences before restarting the service.
Patch Information
The vulnerability is fixed in rclone 1.75.1. The fix adds validation that the computed mountpoint remains within drv.root in both newVolume() and Volume.restoreState(). Refer to the GitHub Security Advisory for the patch commit and release notes.
Workarounds
- Restrict access to the rclone plugin socket so only the trusted Docker daemon can issue VolumeDriver.Create requests.
- In multi-tenant orchestration, deny workloads the ability to create named volumes with the rclone driver until the plugin is upgraded.
- Run the rclone plugin under a dedicated, unprivileged user account and confine writable paths using systemd ReadOnlyPaths or equivalent Linux Security Module policy to limit the impact of directory creation outside drv.root.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
