9.2
Critical
CVE-2026-41176 Rclone is a command-line program to sync files and directories to and from different cloud storage providers
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| rclone 1.45 | 1.45.0 → < 1.73.5 | 1.73.5 |
| OpenShift API for Data Protection | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of rclone
The 42 CVEs of rclone →
CVE-2026-116196
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
6.0
Medium
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which…
7.0
High
CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…
7.6
High
CVE-2026-116192
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
8.2
High